@strapi/admin 5.50.1 → 5.51.0

package/dist/server/server/src/services/user.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"user.mjs","sources":["../../../../../server/src/services/user.ts"],"sourcesContent":["/* eslint-disable @typescript-eslint/no-non-null-assertion */\nimport _ from 'lodash';\nimport { defaults } from 'lodash/fp';\nimport { arrays, errors } from '@strapi/utils';\nimport type { Data } from '@strapi/types';\nimport { createUser, hasSuperAdminRole } from '../domain/user';\nimport type {\n  AdminUser,\n  AdminRole,\n  AdminUserCreationPayload,\n  SanitizedAdminUser,\n  SanitizedAdminRole,\n  AdminUserUpdatePayload,\n  // eslint-disable-next-line node/no-unpublished-import\n} from '../../../shared/contracts/shared';\nimport { password as passwordValidator } from '../validation/common-validators';\nimport { getService } from '../utils';\nimport constants from './constants';\n\nconst { SUPER_ADMIN_CODE } = constants;\n\nconst { ApplicationError, ValidationError } = errors;\nconst sanitizeUserRoles = (role: AdminRole): SanitizedAdminRole =>\n  _.pick(role, ['id', 'name', 'description', 'code']);\n\nconst getSessionManager = () => {\n  const manager = strapi.sessionManager;\n  return manager ?? null;\n};\n\n/**\n * Remove private user fields\n * @param  user - user to sanitize\n */\nconst sanitizeUser = (user: AdminUser): SanitizedAdminUser => {\n  return {\n    ..._.omit(user, ['password', 'resetPasswordToken', 'registrationToken', 'roles']),\n    roles: user.roles && user.roles.map(sanitizeUserRoles),\n  };\n};\n\n/**\n * Create and save a user in database\n * @param attributes A partial user object\n */\nconst createUserInDatabase = async (\n  // isActive is added in the controller, it's not sent by the API.\n  attributes: Partial<AdminUserCreationPayload> & { isActive?: true }\n): Promise<AdminUser> => {\n  const userInfo = {\n    registrationToken: getService('token').createToken(),\n    ...attributes,\n  };\n\n  if (_.has(attributes, 'password')) {\n    userInfo.password = await getService('auth').hashPassword(attributes.password!);\n  }\n\n  const user = createUser(userInfo);\n\n  const createdUser = await strapi.db\n    .query('admin::user')\n    .create({ data: user, populate: ['roles'] });\n\n  return createdUser;\n};\n\nconst emitUserCreated = (user: AdminUser) => {\n  getService('metrics').sendDidInviteUser();\n\n  strapi.eventHub.emit('user.create', { user: sanitizeUser(user) });\n};\n\nconst create = async (\n  // isActive is added in the controller, it's not sent by the API.\n  attributes: Partial<AdminUserCreationPayload> & { isActive?: true }\n): Promise<AdminUser> => {\n  const createdUser = await createUserInDatabase(attributes);\n\n  emitUserCreated(createdUser);\n\n  return createdUser;\n};\n\nconst createFirstAdmin = async (\n  attributes: Omit<Partial<AdminUserCreationPayload>, 'registrationToken' | 'isActive' | 'roles'>\n): Promise<AdminUser> => {\n  const createdUser = await strapi.db.transaction(async ({ trx }) => {\n    // Serialize first-admin creation across processes by locking a stable role row.\n    // SQLite ignores FOR UPDATE, but falls back to its single-writer transaction behavior.\n    const superAdminRole = await strapi.db\n      .queryBuilder('admin::role')\n      .select(['id'])\n      .where({ code: SUPER_ADMIN_CODE })\n      .first()\n      .transacting(trx)\n      .forUpdate()\n      .execute<AdminRole | undefined>();\n\n    if (!superAdminRole) {\n      throw new ApplicationError(\n        \"Cannot register the first admin because the super admin role doesn't exist.\"\n      );\n    }\n\n    const hasAdmin = await exists();\n\n    if (hasAdmin) {\n      throw new ApplicationError('You cannot register a new super admin');\n    }\n\n    return createUserInDatabase({\n      ...attributes,\n      registrationToken: null,\n      isActive: true,\n      roles: [superAdminRole.id],\n    });\n  });\n\n  emitUserCreated(createdUser);\n\n  return createdUser;\n};\n\n/**\n * Update a user in database\n * @param id query params to find the user to update\n * @param attributes A partial user object\n */\nconst updateById = async (\n  id: Data.ID,\n  attributes: Partial<AdminUserUpdatePayload>\n): Promise<AdminUser> => {\n  // Check at least one super admin remains\n  if (_.has(attributes, 'roles')) {\n    const lastAdminUser = await isLastSuperAdminUser(id);\n    const superAdminRole = await getService('role').getSuperAdminWithUsersCount();\n    const willRemoveSuperAdminRole = !arrays.includesString(attributes.roles!, superAdminRole.id);\n\n    if (lastAdminUser && willRemoveSuperAdminRole) {\n      throw new ValidationError('You must have at least one user with super admin role.');\n    }\n  }\n\n  // cannot disable last super admin\n  if (attributes.isActive === false) {\n    const lastAdminUser = await isLastSuperAdminUser(id);\n    if (lastAdminUser) {\n      throw new ValidationError('You must have at least one user with super admin role.');\n    }\n  }\n\n  // hash password if a new one is sent\n  if (_.has(attributes, 'password')) {\n    const hashedPassword = await getService('auth').hashPassword(attributes.password!);\n\n    const updatedUser = await strapi.db.query('admin::user').update({\n      where: { id },\n      data: {\n        ...attributes,\n        password: hashedPassword,\n      },\n      populate: ['roles'],\n    });\n\n    strapi.eventHub.emit('user.update', { user: sanitizeUser(updatedUser) });\n\n    return updatedUser;\n  }\n\n  const updatedUser = await strapi.db.query('admin::user').update({\n    where: { id },\n    data: attributes,\n    populate: ['roles'],\n  });\n\n  if (updatedUser) {\n    strapi.eventHub.emit('user.update', { user: sanitizeUser(updatedUser) });\n  }\n\n  return updatedUser;\n};\n\n/**\n * Reset a user password by email. (Used in admin:reset CLI)\n * @param email - user email\n * @param password - new password\n */\nconst resetPasswordByEmail = async (email: string, password: string) => {\n  const user = await strapi.db\n    .query('admin::user')\n    .findOne({ where: { email }, populate: ['roles'] });\n\n  if (!user) {\n    throw new Error(`User not found for email: ${email}`);\n  }\n\n  try {\n    await passwordValidator.validate(password);\n  } catch (error) {\n    throw new ValidationError(\n      'Invalid password. Expected a minimum of 8 characters with at least one number and one uppercase letter'\n    );\n  }\n\n  await updateById(user.id, { password });\n};\n\n/**\n * Check if a user is the last super admin\n * @param userId user's id to look for\n */\nconst isLastSuperAdminUser = async (userId: Data.ID): Promise<boolean> => {\n  const user = (await findOne(userId)) as AdminUser | null;\n  if (!user) return false;\n\n  const superAdminRole = await getService('role').getSuperAdminWithUsersCount();\n\n  return superAdminRole.usersCount === 1 && hasSuperAdminRole(user);\n};\n\n/**\n * Check if a user is the first super admin\n * @param userId user's id to look for\n */\nconst isFirstSuperAdminUser = async (userId: Data.ID): Promise<boolean> => {\n  const currentUser = (await findOne(userId)) as AdminUser | null;\n\n  if (!currentUser || !hasSuperAdminRole(currentUser)) return false;\n\n  const [oldestUser] = await strapi.db.query('admin::user').findMany({\n    populate: {\n      roles: {\n        where: {\n          code: { $eq: SUPER_ADMIN_CODE },\n        },\n      },\n    },\n    orderBy: { createdAt: 'asc' },\n    limit: 1,\n    select: ['id'],\n  });\n\n  return oldestUser.id === currentUser.id;\n};\n\n/**\n * Check if a user with specific attributes exists in the database\n * @param attributes A partial user object\n */\nconst exists = async (attributes = {} as unknown): Promise<boolean> => {\n  return (await strapi.db.query('admin::user').count({ where: attributes })) > 0;\n};\n\n/**\n * Returns a user registration info\n * @param registrationToken - a user registration token\n * @returns - Returns user email, firstname and lastname\n */\nconst findRegistrationInfo = async (\n  registrationToken: string\n): Promise<Pick<AdminUser, 'email' | 'firstname' | 'lastname'> | undefined> => {\n  const user = await strapi.db.query('admin::user').findOne({ where: { registrationToken } });\n\n  if (!user) {\n    return undefined;\n  }\n\n  return _.pick(user, ['email', 'firstname', 'lastname']);\n};\n\n/**\n * Registers a user based on a registrationToken and some informations to update\n * @param params\n * @param params.registrationToken registration token\n * @param params.userInfo user info\n */\nconst register = async ({\n  registrationToken,\n  userInfo,\n}: {\n  registrationToken: string;\n  userInfo: Partial<AdminUser>;\n}) => {\n  const matchingUser = await strapi.db\n    .query('admin::user')\n    .findOne({ where: { registrationToken } });\n\n  if (!matchingUser) {\n    throw new ValidationError('Invalid registration info');\n  }\n\n  return getService('user').updateById(matchingUser.id, {\n    password: userInfo.password,\n    firstname: userInfo.firstname,\n    lastname: userInfo.lastname,\n    registrationToken: null,\n    isActive: true,\n  });\n};\n\n/**\n * Find one user\n */\nconst findOne = async (id: Data.ID, populate = ['roles']) => {\n  return strapi.db.query('admin::user').findOne({ where: { id }, populate });\n};\n\n/**\n * Find one user by its email\n * @param email\n * @param populate\n * @returns\n */\nconst findOneByEmail = async (email: string, populate = []) => {\n  return strapi.db.query('admin::user').findOne({\n    where: { email: { $eqi: email } },\n    populate,\n  });\n};\n\n/** Find many users (paginated)\n * @param params\n */\nconst findPage = async (params = {}): Promise<unknown> => {\n  const query = strapi\n    .get('query-params')\n    .transform('admin::user', defaults({ populate: ['roles'] }, params));\n\n  return strapi.db.query('admin::user').findPage(query);\n};\n\n/** Delete a user\n * @param id id of the user to delete\n */\nconst deleteById = async (id: Data.ID): Promise<AdminUser | null> => {\n  // Check at least one super admin remains\n  const userToDelete: AdminUser | null = await strapi.db.query('admin::user').findOne({\n    where: { id },\n    populate: ['roles'],\n  });\n\n  if (!userToDelete) {\n    return null;\n  }\n\n  if (userToDelete) {\n    if (userToDelete.roles.some((r) => r.code === SUPER_ADMIN_CODE)) {\n      const superAdminRole = await getService('role').getSuperAdminWithUsersCount();\n      if (superAdminRole.usersCount === 1) {\n        throw new ValidationError('You must have at least one user with super admin role.');\n      }\n    }\n  }\n\n  const deletedUser = await strapi.db\n    .query('admin::user')\n    .delete({ where: { id }, populate: ['roles'] });\n\n  // Invalidate all sessions for the deleted user\n  const sessionManager = getSessionManager();\n  if (sessionManager && sessionManager.hasOrigin('admin')) {\n    await sessionManager('admin').invalidateRefreshToken(String(id));\n  }\n\n  strapi.eventHub.emit('user.delete', { user: sanitizeUser(deletedUser) });\n\n  return deletedUser;\n};\n\n/** Delete a user\n * @param ids ids of the users to delete\n */\nconst deleteByIds = async (ids: (string | number)[]): Promise<AdminUser[]> => {\n  // Check at least one super admin remains\n  const superAdminRole = await getService('role').getSuperAdminWithUsersCount();\n  const nbOfSuperAdminToDelete = await strapi.db.query('admin::user').count({\n    where: {\n      id: ids,\n      roles: { id: superAdminRole.id },\n    },\n  });\n\n  if (superAdminRole.usersCount === nbOfSuperAdminToDelete) {\n    throw new ValidationError('You must have at least one user with super admin role.');\n  }\n\n  const deletedUsers = [] as AdminUser[];\n  for (const id of ids) {\n    const deletedUser = await strapi.db.query('admin::user').delete({\n      where: { id },\n      populate: ['roles'],\n    });\n\n    // Invalidate all sessions for the deleted user\n    const sessionManager = getSessionManager();\n    if (sessionManager && sessionManager.hasOrigin('admin')) {\n      await sessionManager('admin').invalidateRefreshToken(String(id));\n    }\n\n    deletedUsers.push(deletedUser);\n  }\n\n  strapi.eventHub.emit('user.delete', {\n    users: deletedUsers.map((deletedUser) => sanitizeUser(deletedUser)),\n  });\n\n  return deletedUsers;\n};\n\n/** Count the users that don't have any associated roles\n */\nconst countUsersWithoutRole = async (): Promise<number> => {\n  return strapi.db.query('admin::user').count({\n    where: {\n      roles: {\n        id: { $null: true },\n      },\n    },\n  });\n};\n\n/**\n * Count the number of users based on search params\n * @param params params used for the query\n */\nconst count = async (where = {}): Promise<number> => {\n  return strapi.db.query('admin::user').count({ where });\n};\n\n/**\n * Assign some roles to several users\n */\nconst assignARoleToAll = async (roleId: Data.ID): Promise<void> => {\n  const users = await strapi.db.query('admin::user').findMany({\n    select: ['id'],\n    where: {\n      roles: { id: { $null: true } },\n    },\n  });\n\n  await Promise.all(\n    users.map((user) => {\n      return strapi.db.query('admin::user').update({\n        where: { id: user.id },\n        data: { roles: [roleId] },\n      });\n    })\n  );\n};\n\n/** Display a warning if some users don't have at least one role\n */\nconst displayWarningIfUsersDontHaveRole = async (): Promise<void> => {\n  const count = await countUsersWithoutRole();\n\n  if (count > 0) {\n    strapi.log.warn(`Some users (${count}) don't have any role.`);\n  }\n};\n\n/** Returns an array of interface languages currently used by users\n */\nconst getLanguagesInUse = async (): Promise<string[]> => {\n  const users = await strapi.db.query('admin::user').findMany({ select: ['preferedLanguage'] });\n\n  return users.map((user) => user.preferedLanguage || 'en');\n};\nexport default {\n  create,\n  createFirstAdmin,\n  updateById,\n  exists,\n  findRegistrationInfo,\n  register,\n  sanitizeUser,\n  findOne,\n  findOneByEmail,\n  findPage,\n  deleteById,\n  deleteByIds,\n  countUsersWithoutRole,\n  count,\n  assignARoleToAll,\n  displayWarningIfUsersDontHaveRole,\n  resetPasswordByEmail,\n  getLanguagesInUse,\n  isFirstSuperAdminUser,\n};\n"],"names":["SUPER_ADMIN_CODE","constants","ApplicationError","ValidationError","errors","sanitizeUserRoles","role","_","pick","getSessionManager","manager","strapi","sessionManager","sanitizeUser","user","omit","roles","map","createUserInDatabase","attributes","userInfo","registrationToken","getService","createToken","has","password","hashPassword","createUser","createdUser","db","query","create","data","populate","emitUserCreated","sendDidInviteUser","eventHub","emit","createFirstAdmin","transaction","trx","superAdminRole","queryBuilder","select","where","code","first","transacting","forUpdate","execute","hasAdmin","exists","isActive","id","updateById","lastAdminUser","isLastSuperAdminUser","getSuperAdminWithUsersCount","willRemoveSuperAdminRole","arrays","includesString","hashedPassword","updatedUser","update","resetPasswordByEmail","email","findOne","Error","passwordValidator","validate","error","userId","usersCount","hasSuperAdminRole","isFirstSuperAdminUser","currentUser","oldestUser","findMany","$eq","orderBy","createdAt","limit","count","findRegistrationInfo","undefined","register","matchingUser","firstname","lastname","findOneByEmail","$eqi","findPage","params","get","transform","defaults","deleteById","userToDelete","some","r","deletedUser","delete","hasOrigin","invalidateRefreshToken","String","deleteByIds","ids","nbOfSuperAdminToDelete","deletedUsers","push","users","countUsersWithoutRole","$null","assignARoleToAll","roleId","Promise","all","displayWarningIfUsersDontHaveRole","log","warn","getLanguagesInUse","preferedLanguage"],"mappings":";;;;;;;;AAmBA,MAAM,EAAEA,gBAAgB,EAAE,GAAGC,SAAAA;AAE7B,MAAM,EAAEC,gBAAgB,EAAEC,eAAe,EAAE,GAAGC,MAAAA;AAC9C,MAAMC,oBAAoB,CAACC,IAAAA,GACzBC,UAAAA,CAAEC,IAAI,CAACF,IAAAA,EAAM;AAAC,QAAA,IAAA;AAAM,QAAA,MAAA;AAAQ,QAAA,aAAA;AAAe,QAAA;AAAO,KAAA,CAAA;AAEpD,MAAMG,iBAAAA,GAAoB,IAAA;IACxB,MAAMC,OAAAA,GAAUC,OAAOC,cAAc;AACrC,IAAA,OAAOF,OAAAA,IAAW,IAAA;AACpB,CAAA;AAEA;;;IAIA,MAAMG,eAAe,CAACC,IAAAA,GAAAA;IACpB,OAAO;QACL,GAAGP,UAAAA,CAAEQ,IAAI,CAACD,IAAAA,EAAM;AAAC,YAAA,UAAA;AAAY,YAAA,oBAAA;AAAsB,YAAA,mBAAA;AAAqB,YAAA;SAAQ,CAAC;AACjFE,QAAAA,KAAAA,EAAOF,KAAKE,KAAK,IAAIF,KAAKE,KAAK,CAACC,GAAG,CAACZ,iBAAAA;AACtC,KAAA;AACF,CAAA;AAEA;;;IAIA,MAAMa,oBAAAA,GAAuB;AAE3BC,UAAAA,GAAAA;AAEA,IAAA,MAAMC,QAAAA,GAAW;QACfC,iBAAAA,EAAmBC,UAAAA,CAAW,SAASC,WAAW,EAAA;AAClD,QAAA,GAAGJ;AACL,KAAA;AAEA,IAAA,IAAIZ,UAAAA,CAAEiB,GAAG,CAACL,UAAAA,EAAY,UAAA,CAAA,EAAa;QACjCC,QAAAA,CAASK,QAAQ,GAAG,MAAMH,UAAAA,CAAW,QAAQI,YAAY,CAACP,WAAWM,QAAQ,CAAA;AAC/E,IAAA;AAEA,IAAA,MAAMX,OAAOa,UAAAA,CAAWP,QAAAA,CAAAA;IAExB,MAAMQ,WAAAA,GAAc,MAAMjB,MAAAA,CAAOkB,EAAE,CAChCC,KAAK,CAAC,aAAA,CAAA,CACNC,MAAM,CAAC;QAAEC,IAAAA,EAAMlB,IAAAA;QAAMmB,QAAAA,EAAU;AAAC,YAAA;AAAQ;AAAC,KAAA,CAAA;IAE5C,OAAOL,WAAAA;AACT,CAAA;AAEA,MAAMM,kBAAkB,CAACpB,IAAAA,GAAAA;AACvBQ,IAAAA,UAAAA,CAAW,WAAWa,iBAAiB,EAAA;AAEvCxB,IAAAA,MAAAA,CAAOyB,QAAQ,CAACC,IAAI,CAAC,aAAA,EAAe;AAAEvB,QAAAA,IAAAA,EAAMD,YAAAA,CAAaC,IAAAA;AAAM,KAAA,CAAA;AACjE,CAAA;AAEA,MAAMiB,MAAAA,GAAS;AAEbZ,UAAAA,GAAAA;IAEA,MAAMS,WAAAA,GAAc,MAAMV,oBAAAA,CAAqBC,UAAAA,CAAAA;IAE/Ce,eAAAA,CAAgBN,WAAAA,CAAAA;IAEhB,OAAOA,WAAAA;AACT,CAAA;AAEA,MAAMU,mBAAmB,OACvBnB,UAAAA,GAAAA;IAEA,MAAMS,WAAAA,GAAc,MAAMjB,MAAAA,CAAOkB,EAAE,CAACU,WAAW,CAAC,OAAO,EAAEC,GAAG,EAAE,GAAA;;;QAG5D,MAAMC,cAAAA,GAAiB,MAAM9B,MAAAA,CAAOkB,EAAE,CACnCa,YAAY,CAAC,aAAA,CAAA,CACbC,MAAM,CAAC;AAAC,YAAA;AAAK,SAAA,CAAA,CACbC,KAAK,CAAC;YAAEC,IAAAA,EAAM7C;AAAiB,SAAA,CAAA,CAC/B8C,KAAK,EAAA,CACLC,WAAW,CAACP,GAAAA,CAAAA,CACZQ,SAAS,GACTC,OAAO,EAAA;AAEV,QAAA,IAAI,CAACR,cAAAA,EAAgB;AACnB,YAAA,MAAM,IAAIvC,gBAAAA,CACR,6EAAA,CAAA;AAEJ,QAAA;AAEA,QAAA,MAAMgD,WAAW,MAAMC,MAAAA,EAAAA;AAEvB,QAAA,IAAID,QAAAA,EAAU;AACZ,YAAA,MAAM,IAAIhD,gBAAAA,CAAiB,uCAAA,CAAA;AAC7B,QAAA;AAEA,QAAA,OAAOgB,oBAAAA,CAAqB;AAC1B,YAAA,GAAGC,UAAU;YACbE,iBAAAA,EAAmB,IAAA;YACnB+B,QAAAA,EAAU,IAAA;YACVpC,KAAAA,EAAO;AAACyB,gBAAAA,cAAAA,CAAeY;AAAG;AAC5B,SAAA,CAAA;AACF,IAAA,CAAA,CAAA;IAEAnB,eAAAA,CAAgBN,WAAAA,CAAAA;IAEhB,OAAOA,WAAAA;AACT,CAAA;AAEA;;;;IAKA,MAAM0B,UAAAA,GAAa,OACjBD,EAAAA,EACAlC,UAAAA,GAAAA;;AAGA,IAAA,IAAIZ,UAAAA,CAAEiB,GAAG,CAACL,UAAAA,EAAY,OAAA,CAAA,EAAU;QAC9B,MAAMoC,aAAAA,GAAgB,MAAMC,oBAAAA,CAAqBH,EAAAA,CAAAA;AACjD,QAAA,MAAMZ,cAAAA,GAAiB,MAAMnB,UAAAA,CAAW,MAAA,CAAA,CAAQmC,2BAA2B,EAAA;QAC3E,MAAMC,wBAAAA,GAA2B,CAACC,MAAAA,CAAOC,cAAc,CAACzC,UAAAA,CAAWH,KAAK,EAAGyB,cAAAA,CAAeY,EAAE,CAAA;AAE5F,QAAA,IAAIE,iBAAiBG,wBAAAA,EAA0B;AAC7C,YAAA,MAAM,IAAIvD,eAAAA,CAAgB,wDAAA,CAAA;AAC5B,QAAA;AACF,IAAA;;IAGA,IAAIgB,UAAAA,CAAWiC,QAAQ,KAAK,KAAA,EAAO;QACjC,MAAMG,aAAAA,GAAgB,MAAMC,oBAAAA,CAAqBH,EAAAA,CAAAA;AACjD,QAAA,IAAIE,aAAAA,EAAe;AACjB,YAAA,MAAM,IAAIpD,eAAAA,CAAgB,wDAAA,CAAA;AAC5B,QAAA;AACF,IAAA;;AAGA,IAAA,IAAII,UAAAA,CAAEiB,GAAG,CAACL,UAAAA,EAAY,UAAA,CAAA,EAAa;AACjC,QAAA,MAAM0C,iBAAiB,MAAMvC,UAAAA,CAAW,QAAQI,YAAY,CAACP,WAAWM,QAAQ,CAAA;QAEhF,MAAMqC,WAAAA,GAAc,MAAMnD,MAAAA,CAAOkB,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAeiC,MAAM,CAAC;YAC9DnB,KAAAA,EAAO;AAAES,gBAAAA;AAAG,aAAA;YACZrB,IAAAA,EAAM;AACJ,gBAAA,GAAGb,UAAU;gBACbM,QAAAA,EAAUoC;AACZ,aAAA;YACA5B,QAAAA,EAAU;AAAC,gBAAA;AAAQ;AACrB,SAAA,CAAA;AAEAtB,QAAAA,MAAAA,CAAOyB,QAAQ,CAACC,IAAI,CAAC,aAAA,EAAe;AAAEvB,YAAAA,IAAAA,EAAMD,YAAAA,CAAaiD,WAAAA;AAAa,SAAA,CAAA;QAEtE,OAAOA,WAAAA;AACT,IAAA;IAEA,MAAMA,WAAAA,GAAc,MAAMnD,MAAAA,CAAOkB,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAeiC,MAAM,CAAC;QAC9DnB,KAAAA,EAAO;AAAES,YAAAA;AAAG,SAAA;QACZrB,IAAAA,EAAMb,UAAAA;QACNc,QAAAA,EAAU;AAAC,YAAA;AAAQ;AACrB,KAAA,CAAA;AAEA,IAAA,IAAI6B,WAAAA,EAAa;AACfnD,QAAAA,MAAAA,CAAOyB,QAAQ,CAACC,IAAI,CAAC,aAAA,EAAe;AAAEvB,YAAAA,IAAAA,EAAMD,YAAAA,CAAaiD,WAAAA;AAAa,SAAA,CAAA;AACxE,IAAA;IAEA,OAAOA,WAAAA;AACT,CAAA;AAEA;;;;IAKA,MAAME,oBAAAA,GAAuB,OAAOC,KAAAA,EAAexC,UAAAA,GAAAA;IACjD,MAAMX,IAAAA,GAAO,MAAMH,MAAAA,CAAOkB,EAAE,CACzBC,KAAK,CAAC,aAAA,CAAA,CACNoC,OAAO,CAAC;QAAEtB,KAAAA,EAAO;AAAEqB,YAAAA;AAAM,SAAA;QAAGhC,QAAAA,EAAU;AAAC,YAAA;AAAQ;AAAC,KAAA,CAAA;AAEnD,IAAA,IAAI,CAACnB,IAAAA,EAAM;AACT,QAAA,MAAM,IAAIqD,KAAAA,CAAM,CAAC,0BAA0B,EAAEF,KAAAA,CAAAA,CAAO,CAAA;AACtD,IAAA;IAEA,IAAI;QACF,MAAMG,QAAAA,CAAkBC,QAAQ,CAAC5C,UAAAA,CAAAA;AACnC,IAAA,CAAA,CAAE,OAAO6C,KAAAA,EAAO;AACd,QAAA,MAAM,IAAInE,eAAAA,CACR,wGAAA,CAAA;AAEJ,IAAA;IAEA,MAAMmD,UAAAA,CAAWxC,IAAAA,CAAKuC,EAAE,EAAE;AAAE5B,kBAAAA;AAAS,KAAA,CAAA;AACvC,CAAA;AAEA;;;IAIA,MAAM+B,uBAAuB,OAAOe,MAAAA,GAAAA;IAClC,MAAMzD,IAAAA,GAAQ,MAAMoD,OAAAA,CAAQK,MAAAA,CAAAA;IAC5B,IAAI,CAACzD,MAAM,OAAO,KAAA;AAElB,IAAA,MAAM2B,cAAAA,GAAiB,MAAMnB,UAAAA,CAAW,MAAA,CAAA,CAAQmC,2BAA2B,EAAA;AAE3E,IAAA,OAAOhB,cAAAA,CAAe+B,UAAU,KAAK,CAAA,IAAKC,iBAAAA,CAAkB3D,IAAAA,CAAAA;AAC9D,CAAA;AAEA;;;IAIA,MAAM4D,wBAAwB,OAAOH,MAAAA,GAAAA;IACnC,MAAMI,WAAAA,GAAe,MAAMT,OAAAA,CAAQK,MAAAA,CAAAA;AAEnC,IAAA,IAAI,CAACI,WAAAA,IAAe,CAACF,iBAAAA,CAAkBE,cAAc,OAAO,KAAA;IAE5D,MAAM,CAACC,UAAAA,CAAW,GAAG,MAAMjE,MAAAA,CAAOkB,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAe+C,QAAQ,CAAC;QACjE5C,QAAAA,EAAU;YACRjB,KAAAA,EAAO;gBACL4B,KAAAA,EAAO;oBACLC,IAAAA,EAAM;wBAAEiC,GAAAA,EAAK9E;AAAiB;AAChC;AACF;AACF,SAAA;QACA+E,OAAAA,EAAS;YAAEC,SAAAA,EAAW;AAAM,SAAA;QAC5BC,KAAAA,EAAO,CAAA;QACPtC,MAAAA,EAAQ;AAAC,YAAA;AAAK;AAChB,KAAA,CAAA;AAEA,IAAA,OAAOiC,UAAAA,CAAWvB,EAAE,KAAKsB,WAAAA,CAAYtB,EAAE;AACzC,CAAA;AAEA;;;AAGC,IACD,MAAMF,MAAAA,GAAS,OAAOhC,UAAAA,GAAa,EAAa,GAAA;IAC9C,OAAQ,MAAMR,MAAAA,CAAOkB,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAeoD,KAAK,CAAC;QAAEtC,KAAAA,EAAOzB;KAAW,CAAA,GAAM,CAAA;AAC/E,CAAA;AAEA;;;;IAKA,MAAMgE,uBAAuB,OAC3B9D,iBAAAA,GAAAA;IAEA,MAAMP,IAAAA,GAAO,MAAMH,MAAAA,CAAOkB,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAeoC,OAAO,CAAC;QAAEtB,KAAAA,EAAO;AAAEvB,YAAAA;AAAkB;AAAE,KAAA,CAAA;AAEzF,IAAA,IAAI,CAACP,IAAAA,EAAM;QACT,OAAOsE,SAAAA;AACT,IAAA;IAEA,OAAO7E,UAAAA,CAAEC,IAAI,CAACM,IAAAA,EAAM;AAAC,QAAA,OAAA;AAAS,QAAA,WAAA;AAAa,QAAA;AAAW,KAAA,CAAA;AACxD,CAAA;AAEA;;;;;AAKC,IACD,MAAMuE,QAAAA,GAAW,OAAO,EACtBhE,iBAAiB,EACjBD,QAAQ,EAIT,GAAA;IACC,MAAMkE,YAAAA,GAAe,MAAM3E,MAAAA,CAAOkB,EAAE,CACjCC,KAAK,CAAC,aAAA,CAAA,CACNoC,OAAO,CAAC;QAAEtB,KAAAA,EAAO;AAAEvB,YAAAA;AAAkB;AAAE,KAAA,CAAA;AAE1C,IAAA,IAAI,CAACiE,YAAAA,EAAc;AACjB,QAAA,MAAM,IAAInF,eAAAA,CAAgB,2BAAA,CAAA;AAC5B,IAAA;AAEA,IAAA,OAAOmB,WAAW,MAAA,CAAA,CAAQgC,UAAU,CAACgC,YAAAA,CAAajC,EAAE,EAAE;AACpD5B,QAAAA,QAAAA,EAAUL,SAASK,QAAQ;AAC3B8D,QAAAA,SAAAA,EAAWnE,SAASmE,SAAS;AAC7BC,QAAAA,QAAAA,EAAUpE,SAASoE,QAAQ;QAC3BnE,iBAAAA,EAAmB,IAAA;QACnB+B,QAAAA,EAAU;AACZ,KAAA,CAAA;AACF,CAAA;AAEA;;AAEC,IACD,MAAMc,OAAAA,GAAU,OAAOb,EAAAA,EAAapB,QAAAA,GAAW;AAAC,IAAA;AAAQ,CAAA,GAAA;AACtD,IAAA,OAAOtB,OAAOkB,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAeoC,OAAO,CAAC;QAAEtB,KAAAA,EAAO;AAAES,YAAAA;AAAG,SAAA;AAAGpB,QAAAA;AAAS,KAAA,CAAA;AAC1E,CAAA;AAEA;;;;;AAKC,IACD,MAAMwD,cAAAA,GAAiB,OAAOxB,KAAAA,EAAehC,WAAW,EAAE,GAAA;AACxD,IAAA,OAAOtB,OAAOkB,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAeoC,OAAO,CAAC;QAC5CtB,KAAAA,EAAO;YAAEqB,KAAAA,EAAO;gBAAEyB,IAAAA,EAAMzB;AAAM;AAAE,SAAA;AAChChC,QAAAA;AACF,KAAA,CAAA;AACF,CAAA;AAEA;;AAEC,IACD,MAAM0D,QAAAA,GAAW,OAAOC,MAAAA,GAAS,EAAE,GAAA;IACjC,MAAM9D,KAAAA,GAAQnB,OACXkF,GAAG,CAAC,gBACJC,SAAS,CAAC,eAAeC,QAAAA,CAAS;QAAE9D,QAAAA,EAAU;AAAC,YAAA;AAAQ;KAAC,EAAG2D,MAAAA,CAAAA,CAAAA;AAE9D,IAAA,OAAOjF,OAAOkB,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAe6D,QAAQ,CAAC7D,KAAAA,CAAAA;AACjD,CAAA;AAEA;;IAGA,MAAMkE,aAAa,OAAO3C,EAAAA,GAAAA;;IAExB,MAAM4C,YAAAA,GAAiC,MAAMtF,MAAAA,CAAOkB,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAeoC,OAAO,CAAC;QAClFtB,KAAAA,EAAO;AAAES,YAAAA;AAAG,SAAA;QACZpB,QAAAA,EAAU;AAAC,YAAA;AAAQ;AACrB,KAAA,CAAA;AAEA,IAAA,IAAI,CAACgE,YAAAA,EAAc;QACjB,OAAO,IAAA;AACT,IAAA;AAEA,IAAA,IAAIA,YAAAA,EAAc;QAChB,IAAIA,YAAAA,CAAajF,KAAK,CAACkF,IAAI,CAAC,CAACC,CAAAA,GAAMA,CAAAA,CAAEtD,IAAI,KAAK7C,gBAAAA,CAAAA,EAAmB;AAC/D,YAAA,MAAMyC,cAAAA,GAAiB,MAAMnB,UAAAA,CAAW,MAAA,CAAA,CAAQmC,2BAA2B,EAAA;YAC3E,IAAIhB,cAAAA,CAAe+B,UAAU,KAAK,CAAA,EAAG;AACnC,gBAAA,MAAM,IAAIrE,eAAAA,CAAgB,wDAAA,CAAA;AAC5B,YAAA;AACF,QAAA;AACF,IAAA;IAEA,MAAMiG,WAAAA,GAAc,MAAMzF,MAAAA,CAAOkB,EAAE,CAChCC,KAAK,CAAC,aAAA,CAAA,CACNuE,MAAM,CAAC;QAAEzD,KAAAA,EAAO;AAAES,YAAAA;AAAG,SAAA;QAAGpB,QAAAA,EAAU;AAAC,YAAA;AAAQ;AAAC,KAAA,CAAA;;AAG/C,IAAA,MAAMrB,cAAAA,GAAiBH,iBAAAA,EAAAA;AACvB,IAAA,IAAIG,cAAAA,IAAkBA,cAAAA,CAAe0F,SAAS,CAAC,OAAA,CAAA,EAAU;AACvD,QAAA,MAAM1F,cAAAA,CAAe,OAAA,CAAA,CAAS2F,sBAAsB,CAACC,MAAAA,CAAOnD,EAAAA,CAAAA,CAAAA;AAC9D,IAAA;AAEA1C,IAAAA,MAAAA,CAAOyB,QAAQ,CAACC,IAAI,CAAC,aAAA,EAAe;AAAEvB,QAAAA,IAAAA,EAAMD,YAAAA,CAAauF,WAAAA;AAAa,KAAA,CAAA;IAEtE,OAAOA,WAAAA;AACT,CAAA;AAEA;;IAGA,MAAMK,cAAc,OAAOC,GAAAA,GAAAA;;AAEzB,IAAA,MAAMjE,cAAAA,GAAiB,MAAMnB,UAAAA,CAAW,MAAA,CAAA,CAAQmC,2BAA2B,EAAA;IAC3E,MAAMkD,sBAAAA,GAAyB,MAAMhG,MAAAA,CAAOkB,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAeoD,KAAK,CAAC;QACxEtC,KAAAA,EAAO;YACLS,EAAAA,EAAIqD,GAAAA;YACJ1F,KAAAA,EAAO;AAAEqC,gBAAAA,EAAAA,EAAIZ,eAAeY;AAAG;AACjC;AACF,KAAA,CAAA;IAEA,IAAIZ,cAAAA,CAAe+B,UAAU,KAAKmC,sBAAAA,EAAwB;AACxD,QAAA,MAAM,IAAIxG,eAAAA,CAAgB,wDAAA,CAAA;AAC5B,IAAA;AAEA,IAAA,MAAMyG,eAAe,EAAE;IACvB,KAAK,MAAMvD,MAAMqD,GAAAA,CAAK;QACpB,MAAMN,WAAAA,GAAc,MAAMzF,MAAAA,CAAOkB,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAeuE,MAAM,CAAC;YAC9DzD,KAAAA,EAAO;AAAES,gBAAAA;AAAG,aAAA;YACZpB,QAAAA,EAAU;AAAC,gBAAA;AAAQ;AACrB,SAAA,CAAA;;AAGA,QAAA,MAAMrB,cAAAA,GAAiBH,iBAAAA,EAAAA;AACvB,QAAA,IAAIG,cAAAA,IAAkBA,cAAAA,CAAe0F,SAAS,CAAC,OAAA,CAAA,EAAU;AACvD,YAAA,MAAM1F,cAAAA,CAAe,OAAA,CAAA,CAAS2F,sBAAsB,CAACC,MAAAA,CAAOnD,EAAAA,CAAAA,CAAAA;AAC9D,QAAA;AAEAuD,QAAAA,YAAAA,CAAaC,IAAI,CAACT,WAAAA,CAAAA;AACpB,IAAA;AAEAzF,IAAAA,MAAAA,CAAOyB,QAAQ,CAACC,IAAI,CAAC,aAAA,EAAe;AAClCyE,QAAAA,KAAAA,EAAOF,YAAAA,CAAa3F,GAAG,CAAC,CAACmF,cAAgBvF,YAAAA,CAAauF,WAAAA,CAAAA;AACxD,KAAA,CAAA;IAEA,OAAOQ,YAAAA;AACT,CAAA;AAEA;AACC,IACD,MAAMG,qBAAAA,GAAwB,UAAA;AAC5B,IAAA,OAAOpG,OAAOkB,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAeoD,KAAK,CAAC;QAC1CtC,KAAAA,EAAO;YACL5B,KAAAA,EAAO;gBACLqC,EAAAA,EAAI;oBAAE2D,KAAAA,EAAO;AAAK;AACpB;AACF;AACF,KAAA,CAAA;AACF,CAAA;AAEA;;;AAGC,IACD,MAAM9B,KAAAA,GAAQ,OAAOtC,KAAAA,GAAQ,EAAE,GAAA;AAC7B,IAAA,OAAOjC,OAAOkB,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAeoD,KAAK,CAAC;AAAEtC,QAAAA;AAAM,KAAA,CAAA;AACtD,CAAA;AAEA;;IAGA,MAAMqE,mBAAmB,OAAOC,MAAAA,GAAAA;IAC9B,MAAMJ,KAAAA,GAAQ,MAAMnG,MAAAA,CAAOkB,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAe+C,QAAQ,CAAC;QAC1DlC,MAAAA,EAAQ;AAAC,YAAA;AAAK,SAAA;QACdC,KAAAA,EAAO;YACL5B,KAAAA,EAAO;gBAAEqC,EAAAA,EAAI;oBAAE2D,KAAAA,EAAO;AAAK;AAAE;AAC/B;AACF,KAAA,CAAA;AAEA,IAAA,MAAMG,QAAQC,GAAG,CACfN,KAAAA,CAAM7F,GAAG,CAAC,CAACH,IAAAA,GAAAA;AACT,QAAA,OAAOH,OAAOkB,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAeiC,MAAM,CAAC;YAC3CnB,KAAAA,EAAO;AAAES,gBAAAA,EAAAA,EAAIvC,KAAKuC;AAAG,aAAA;YACrBrB,IAAAA,EAAM;gBAAEhB,KAAAA,EAAO;AAACkG,oBAAAA;AAAO;AAAC;AAC1B,SAAA,CAAA;AACF,IAAA,CAAA,CAAA,CAAA;AAEJ,CAAA;AAEA;AACC,IACD,MAAMG,iCAAAA,GAAoC,UAAA;AACxC,IAAA,MAAMnC,QAAQ,MAAM6B,qBAAAA,EAAAA;AAEpB,IAAA,IAAI7B,QAAQ,CAAA,EAAG;QACbvE,MAAAA,CAAO2G,GAAG,CAACC,IAAI,CAAC,CAAC,YAAY,EAAErC,KAAAA,CAAM,sBAAsB,CAAC,CAAA;AAC9D,IAAA;AACF,CAAA;AAEA;AACC,IACD,MAAMsC,iBAAAA,GAAoB,UAAA;IACxB,MAAMV,KAAAA,GAAQ,MAAMnG,MAAAA,CAAOkB,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAe+C,QAAQ,CAAC;QAAElC,MAAAA,EAAQ;AAAC,YAAA;AAAmB;AAAC,KAAA,CAAA;AAE3F,IAAA,OAAOmE,MAAM7F,GAAG,CAAC,CAACH,IAAAA,GAASA,IAAAA,CAAK2G,gBAAgB,IAAI,IAAA,CAAA;AACtD,CAAA;AACA,WAAe;AACb1F,IAAAA,MAAAA;AACAO,IAAAA,gBAAAA;AACAgB,IAAAA,UAAAA;AACAH,IAAAA,MAAAA;AACAgC,IAAAA,oBAAAA;AACAE,IAAAA,QAAAA;AACAxE,IAAAA,YAAAA;AACAqD,IAAAA,OAAAA;AACAuB,IAAAA,cAAAA;AACAE,IAAAA,QAAAA;AACAK,IAAAA,UAAAA;AACAS,IAAAA,WAAAA;AACAM,IAAAA,qBAAAA;AACA7B,IAAAA,KAAAA;AACA+B,IAAAA,gBAAAA;AACAI,IAAAA,iCAAAA;AACArD,IAAAA,oBAAAA;AACAwD,IAAAA,iBAAAA;AACA9C,IAAAA;AACF,CAAA;;;;"}
+{"version":3,"file":"user.mjs","sources":["../../../../../server/src/services/user.ts"],"sourcesContent":["/* eslint-disable @typescript-eslint/no-non-null-assertion */\nimport _ from 'lodash';\nimport { defaults } from 'lodash/fp';\nimport { arrays, errors } from '@strapi/utils';\nimport type { Data } from '@strapi/types';\nimport { createUser, hasSuperAdminRole } from '../domain/user';\nimport type {\n  AdminUser,\n  AdminRole,\n  AdminUserCreationPayload,\n  SanitizedAdminUser,\n  SanitizedAdminRole,\n  AdminUserUpdatePayload,\n  // eslint-disable-next-line node/no-unpublished-import\n} from '../../../shared/contracts/shared';\nimport { password as passwordValidator } from '../validation/common-validators';\nimport { getService } from '../utils';\nimport constants from './constants';\n\nconst { SUPER_ADMIN_CODE } = constants;\n\nconst { ApplicationError, ValidationError } = errors;\nconst sanitizeUserRoles = (role: AdminRole): SanitizedAdminRole =>\n  _.pick(role, ['id', 'name', 'description', 'code']);\n\nconst getSessionManager = () => {\n  const manager = strapi.sessionManager;\n  return manager ?? null;\n};\n\n/**\n * Remove private user fields\n * @param  user - user to sanitize\n */\nconst sanitizeUser = (user: AdminUser): SanitizedAdminUser => {\n  return {\n    ..._.omit(user, [\n      'password',\n      'resetPasswordToken',\n      'resetPasswordTokenExpiresAt',\n      'registrationToken',\n      'roles',\n    ]),\n    roles: user.roles && user.roles.map(sanitizeUserRoles),\n  };\n};\n\n/**\n * Create and save a user in database\n * @param attributes A partial user object\n */\nconst createUserInDatabase = async (\n  // isActive is added in the controller, it's not sent by the API.\n  attributes: Partial<AdminUserCreationPayload> & { isActive?: true }\n): Promise<AdminUser> => {\n  const userInfo = {\n    registrationToken: getService('token').createToken(),\n    ...attributes,\n  };\n\n  if (_.has(attributes, 'password')) {\n    userInfo.password = await getService('auth').hashPassword(attributes.password!);\n  }\n\n  const user = createUser(userInfo);\n\n  const createdUser = await strapi.db\n    .query('admin::user')\n    .create({ data: user, populate: ['roles'] });\n\n  return createdUser;\n};\n\nconst emitUserCreated = (user: AdminUser) => {\n  getService('metrics').sendDidInviteUser();\n\n  strapi.eventHub.emit('user.create', { user: sanitizeUser(user) });\n};\n\nconst create = async (\n  // isActive is added in the controller, it's not sent by the API.\n  attributes: Partial<AdminUserCreationPayload> & { isActive?: true }\n): Promise<AdminUser> => {\n  const createdUser = await createUserInDatabase(attributes);\n\n  emitUserCreated(createdUser);\n\n  return createdUser;\n};\n\nconst createFirstAdmin = async (\n  attributes: Omit<Partial<AdminUserCreationPayload>, 'registrationToken' | 'isActive' | 'roles'>\n): Promise<AdminUser> => {\n  const createdUser = await strapi.db.transaction(async ({ trx }) => {\n    // Serialize first-admin creation across processes by locking a stable role row.\n    // SQLite ignores FOR UPDATE, but falls back to its single-writer transaction behavior.\n    const superAdminRole = await strapi.db\n      .queryBuilder('admin::role')\n      .select(['id'])\n      .where({ code: SUPER_ADMIN_CODE })\n      .first()\n      .transacting(trx)\n      .forUpdate()\n      .execute<AdminRole | undefined>();\n\n    if (!superAdminRole) {\n      throw new ApplicationError(\n        \"Cannot register the first admin because the super admin role doesn't exist.\"\n      );\n    }\n\n    const hasAdmin = await exists();\n\n    if (hasAdmin) {\n      throw new ApplicationError('You cannot register a new super admin');\n    }\n\n    return createUserInDatabase({\n      ...attributes,\n      registrationToken: null,\n      isActive: true,\n      roles: [superAdminRole.id],\n    });\n  });\n\n  emitUserCreated(createdUser);\n\n  return createdUser;\n};\n\n/**\n * Update a user in database\n * @param id query params to find the user to update\n * @param attributes A partial user object\n */\nconst updateById = async (\n  id: Data.ID,\n  attributes: Partial<AdminUserUpdatePayload>\n): Promise<AdminUser> => {\n  // Check at least one super admin remains\n  if (_.has(attributes, 'roles')) {\n    const lastAdminUser = await isLastSuperAdminUser(id);\n    const superAdminRole = await getService('role').getSuperAdminWithUsersCount();\n    const willRemoveSuperAdminRole = !arrays.includesString(attributes.roles!, superAdminRole.id);\n\n    if (lastAdminUser && willRemoveSuperAdminRole) {\n      throw new ValidationError('You must have at least one user with super admin role.');\n    }\n  }\n\n  // cannot disable last super admin\n  if (attributes.isActive === false) {\n    const lastAdminUser = await isLastSuperAdminUser(id);\n    if (lastAdminUser) {\n      throw new ValidationError('You must have at least one user with super admin role.');\n    }\n  }\n\n  // hash password if a new one is sent\n  if (_.has(attributes, 'password')) {\n    const hashedPassword = await getService('auth').hashPassword(attributes.password!);\n\n    const updatedUser = await strapi.db.query('admin::user').update({\n      where: { id },\n      data: {\n        ...attributes,\n        password: hashedPassword,\n      },\n      populate: ['roles'],\n    });\n\n    strapi.eventHub.emit('user.update', { user: sanitizeUser(updatedUser) });\n\n    return updatedUser;\n  }\n\n  const updatedUser = await strapi.db.query('admin::user').update({\n    where: { id },\n    data: attributes,\n    populate: ['roles'],\n  });\n\n  if (updatedUser) {\n    strapi.eventHub.emit('user.update', { user: sanitizeUser(updatedUser) });\n  }\n\n  return updatedUser;\n};\n\n/**\n * Reset a user password by email. (Used in admin:reset CLI)\n * @param email - user email\n * @param password - new password\n */\nconst resetPasswordByEmail = async (email: string, password: string) => {\n  const user = await strapi.db\n    .query('admin::user')\n    .findOne({ where: { email }, populate: ['roles'] });\n\n  if (!user) {\n    throw new Error(`User not found for email: ${email}`);\n  }\n\n  try {\n    await passwordValidator.validate(password);\n  } catch (error) {\n    throw new ValidationError(\n      'Invalid password. Expected a minimum of 8 characters with at least one number and one uppercase letter'\n    );\n  }\n\n  await updateById(user.id, { password });\n};\n\n/**\n * Check if a user is the last super admin\n * @param userId user's id to look for\n */\nconst isLastSuperAdminUser = async (userId: Data.ID): Promise<boolean> => {\n  const user = (await findOne(userId)) as AdminUser | null;\n  if (!user) return false;\n\n  const superAdminRole = await getService('role').getSuperAdminWithUsersCount();\n\n  return superAdminRole.usersCount === 1 && hasSuperAdminRole(user);\n};\n\n/**\n * Check if a user is the first super admin\n * @param userId user's id to look for\n */\nconst isFirstSuperAdminUser = async (userId: Data.ID): Promise<boolean> => {\n  const currentUser = (await findOne(userId)) as AdminUser | null;\n\n  if (!currentUser || !hasSuperAdminRole(currentUser)) return false;\n\n  const [oldestUser] = await strapi.db.query('admin::user').findMany({\n    populate: {\n      roles: {\n        where: {\n          code: { $eq: SUPER_ADMIN_CODE },\n        },\n      },\n    },\n    orderBy: { createdAt: 'asc' },\n    limit: 1,\n    select: ['id'],\n  });\n\n  return oldestUser.id === currentUser.id;\n};\n\n/**\n * Check if a user with specific attributes exists in the database\n * @param attributes A partial user object\n */\nconst exists = async (attributes = {} as unknown): Promise<boolean> => {\n  return (await strapi.db.query('admin::user').count({ where: attributes })) > 0;\n};\n\n/**\n * Returns a user registration info\n * @param registrationToken - a user registration token\n * @returns - Returns user email, firstname and lastname\n */\nconst findRegistrationInfo = async (\n  registrationToken: string\n): Promise<Pick<AdminUser, 'email' | 'firstname' | 'lastname'> | undefined> => {\n  const user = await strapi.db.query('admin::user').findOne({ where: { registrationToken } });\n\n  if (!user) {\n    return undefined;\n  }\n\n  return _.pick(user, ['email', 'firstname', 'lastname']);\n};\n\n/**\n * Registers a user based on a registrationToken and some informations to update\n * @param params\n * @param params.registrationToken registration token\n * @param params.userInfo user info\n */\nconst register = async ({\n  registrationToken,\n  userInfo,\n}: {\n  registrationToken: string;\n  userInfo: Partial<AdminUser>;\n}) => {\n  const matchingUser = await strapi.db\n    .query('admin::user')\n    .findOne({ where: { registrationToken } });\n\n  if (!matchingUser) {\n    throw new ValidationError('Invalid registration info');\n  }\n\n  return getService('user').updateById(matchingUser.id, {\n    password: userInfo.password,\n    firstname: userInfo.firstname,\n    lastname: userInfo.lastname,\n    registrationToken: null,\n    isActive: true,\n  });\n};\n\n/**\n * Find one user\n */\nconst findOne = async (id: Data.ID, populate = ['roles']) => {\n  return strapi.db.query('admin::user').findOne({ where: { id }, populate });\n};\n\n/**\n * Find one user by its email\n * @param email\n * @param populate\n * @returns\n */\nconst findOneByEmail = async (email: string, populate = []) => {\n  return strapi.db.query('admin::user').findOne({\n    where: { email: { $eqi: email } },\n    populate,\n  });\n};\n\n/** Find many users (paginated)\n * @param params\n */\nconst findPage = async (params = {}): Promise<unknown> => {\n  const query = strapi\n    .get('query-params')\n    .transform('admin::user', defaults({ populate: ['roles'] }, params));\n\n  return strapi.db.query('admin::user').findPage(query);\n};\n\n/** Delete a user\n * @param id id of the user to delete\n */\nconst deleteById = async (id: Data.ID): Promise<AdminUser | null> => {\n  // Check at least one super admin remains\n  const userToDelete: AdminUser | null = await strapi.db.query('admin::user').findOne({\n    where: { id },\n    populate: ['roles'],\n  });\n\n  if (!userToDelete) {\n    return null;\n  }\n\n  if (userToDelete) {\n    if (userToDelete.roles.some((r) => r.code === SUPER_ADMIN_CODE)) {\n      const superAdminRole = await getService('role').getSuperAdminWithUsersCount();\n      if (superAdminRole.usersCount === 1) {\n        throw new ValidationError('You must have at least one user with super admin role.');\n      }\n    }\n  }\n\n  const deletedUser = await strapi.db\n    .query('admin::user')\n    .delete({ where: { id }, populate: ['roles'] });\n\n  // Invalidate all sessions for the deleted user\n  const sessionManager = getSessionManager();\n  if (sessionManager && sessionManager.hasOrigin('admin')) {\n    await sessionManager('admin').invalidateRefreshToken(String(id));\n  }\n\n  strapi.eventHub.emit('user.delete', { user: sanitizeUser(deletedUser) });\n\n  return deletedUser;\n};\n\n/** Delete a user\n * @param ids ids of the users to delete\n */\nconst deleteByIds = async (ids: (string | number)[]): Promise<AdminUser[]> => {\n  // Check at least one super admin remains\n  const superAdminRole = await getService('role').getSuperAdminWithUsersCount();\n  const nbOfSuperAdminToDelete = await strapi.db.query('admin::user').count({\n    where: {\n      id: ids,\n      roles: { id: superAdminRole.id },\n    },\n  });\n\n  if (superAdminRole.usersCount === nbOfSuperAdminToDelete) {\n    throw new ValidationError('You must have at least one user with super admin role.');\n  }\n\n  const deletedUsers = [] as AdminUser[];\n  for (const id of ids) {\n    const deletedUser = await strapi.db.query('admin::user').delete({\n      where: { id },\n      populate: ['roles'],\n    });\n\n    // Invalidate all sessions for the deleted user\n    const sessionManager = getSessionManager();\n    if (sessionManager && sessionManager.hasOrigin('admin')) {\n      await sessionManager('admin').invalidateRefreshToken(String(id));\n    }\n\n    deletedUsers.push(deletedUser);\n  }\n\n  strapi.eventHub.emit('user.delete', {\n    users: deletedUsers.map((deletedUser) => sanitizeUser(deletedUser)),\n  });\n\n  return deletedUsers;\n};\n\n/** Count the users that don't have any associated roles\n */\nconst countUsersWithoutRole = async (): Promise<number> => {\n  return strapi.db.query('admin::user').count({\n    where: {\n      roles: {\n        id: { $null: true },\n      },\n    },\n  });\n};\n\n/**\n * Count the number of users based on search params\n * @param params params used for the query\n */\nconst count = async (where = {}): Promise<number> => {\n  return strapi.db.query('admin::user').count({ where });\n};\n\n/**\n * Assign some roles to several users\n */\nconst assignARoleToAll = async (roleId: Data.ID): Promise<void> => {\n  const users = await strapi.db.query('admin::user').findMany({\n    select: ['id'],\n    where: {\n      roles: { id: { $null: true } },\n    },\n  });\n\n  await Promise.all(\n    users.map((user) => {\n      return strapi.db.query('admin::user').update({\n        where: { id: user.id },\n        data: { roles: [roleId] },\n      });\n    })\n  );\n};\n\n/** Display a warning if some users don't have at least one role\n */\nconst displayWarningIfUsersDontHaveRole = async (): Promise<void> => {\n  const count = await countUsersWithoutRole();\n\n  if (count > 0) {\n    strapi.log.warn(`Some users (${count}) don't have any role.`);\n  }\n};\n\n/** Returns an array of interface languages currently used by users\n */\nconst getLanguagesInUse = async (): Promise<string[]> => {\n  const users = await strapi.db.query('admin::user').findMany({ select: ['preferedLanguage'] });\n\n  return users.map((user) => user.preferedLanguage || 'en');\n};\nexport default {\n  create,\n  createFirstAdmin,\n  updateById,\n  exists,\n  findRegistrationInfo,\n  register,\n  sanitizeUser,\n  findOne,\n  findOneByEmail,\n  findPage,\n  deleteById,\n  deleteByIds,\n  countUsersWithoutRole,\n  count,\n  assignARoleToAll,\n  displayWarningIfUsersDontHaveRole,\n  resetPasswordByEmail,\n  getLanguagesInUse,\n  isFirstSuperAdminUser,\n};\n"],"names":["SUPER_ADMIN_CODE","constants","ApplicationError","ValidationError","errors","sanitizeUserRoles","role","_","pick","getSessionManager","manager","strapi","sessionManager","sanitizeUser","user","omit","roles","map","createUserInDatabase","attributes","userInfo","registrationToken","getService","createToken","has","password","hashPassword","createUser","createdUser","db","query","create","data","populate","emitUserCreated","sendDidInviteUser","eventHub","emit","createFirstAdmin","transaction","trx","superAdminRole","queryBuilder","select","where","code","first","transacting","forUpdate","execute","hasAdmin","exists","isActive","id","updateById","lastAdminUser","isLastSuperAdminUser","getSuperAdminWithUsersCount","willRemoveSuperAdminRole","arrays","includesString","hashedPassword","updatedUser","update","resetPasswordByEmail","email","findOne","Error","passwordValidator","validate","error","userId","usersCount","hasSuperAdminRole","isFirstSuperAdminUser","currentUser","oldestUser","findMany","$eq","orderBy","createdAt","limit","count","findRegistrationInfo","undefined","register","matchingUser","firstname","lastname","findOneByEmail","$eqi","findPage","params","get","transform","defaults","deleteById","userToDelete","some","r","deletedUser","delete","hasOrigin","invalidateRefreshToken","String","deleteByIds","ids","nbOfSuperAdminToDelete","deletedUsers","push","users","countUsersWithoutRole","$null","assignARoleToAll","roleId","Promise","all","displayWarningIfUsersDontHaveRole","log","warn","getLanguagesInUse","preferedLanguage"],"mappings":";;;;;;;;AAmBA,MAAM,EAAEA,gBAAgB,EAAE,GAAGC,SAAAA;AAE7B,MAAM,EAAEC,gBAAgB,EAAEC,eAAe,EAAE,GAAGC,MAAAA;AAC9C,MAAMC,oBAAoB,CAACC,IAAAA,GACzBC,UAAAA,CAAEC,IAAI,CAACF,IAAAA,EAAM;AAAC,QAAA,IAAA;AAAM,QAAA,MAAA;AAAQ,QAAA,aAAA;AAAe,QAAA;AAAO,KAAA,CAAA;AAEpD,MAAMG,iBAAAA,GAAoB,IAAA;IACxB,MAAMC,OAAAA,GAAUC,OAAOC,cAAc;AACrC,IAAA,OAAOF,OAAAA,IAAW,IAAA;AACpB,CAAA;AAEA;;;IAIA,MAAMG,eAAe,CAACC,IAAAA,GAAAA;IACpB,OAAO;QACL,GAAGP,UAAAA,CAAEQ,IAAI,CAACD,IAAAA,EAAM;AACd,YAAA,UAAA;AACA,YAAA,oBAAA;AACA,YAAA,6BAAA;AACA,YAAA,mBAAA;AACA,YAAA;SACD,CAAC;AACFE,QAAAA,KAAAA,EAAOF,KAAKE,KAAK,IAAIF,KAAKE,KAAK,CAACC,GAAG,CAACZ,iBAAAA;AACtC,KAAA;AACF,CAAA;AAEA;;;IAIA,MAAMa,oBAAAA,GAAuB;AAE3BC,UAAAA,GAAAA;AAEA,IAAA,MAAMC,QAAAA,GAAW;QACfC,iBAAAA,EAAmBC,UAAAA,CAAW,SAASC,WAAW,EAAA;AAClD,QAAA,GAAGJ;AACL,KAAA;AAEA,IAAA,IAAIZ,UAAAA,CAAEiB,GAAG,CAACL,UAAAA,EAAY,UAAA,CAAA,EAAa;QACjCC,QAAAA,CAASK,QAAQ,GAAG,MAAMH,UAAAA,CAAW,QAAQI,YAAY,CAACP,WAAWM,QAAQ,CAAA;AAC/E,IAAA;AAEA,IAAA,MAAMX,OAAOa,UAAAA,CAAWP,QAAAA,CAAAA;IAExB,MAAMQ,WAAAA,GAAc,MAAMjB,MAAAA,CAAOkB,EAAE,CAChCC,KAAK,CAAC,aAAA,CAAA,CACNC,MAAM,CAAC;QAAEC,IAAAA,EAAMlB,IAAAA;QAAMmB,QAAAA,EAAU;AAAC,YAAA;AAAQ;AAAC,KAAA,CAAA;IAE5C,OAAOL,WAAAA;AACT,CAAA;AAEA,MAAMM,kBAAkB,CAACpB,IAAAA,GAAAA;AACvBQ,IAAAA,UAAAA,CAAW,WAAWa,iBAAiB,EAAA;AAEvCxB,IAAAA,MAAAA,CAAOyB,QAAQ,CAACC,IAAI,CAAC,aAAA,EAAe;AAAEvB,QAAAA,IAAAA,EAAMD,YAAAA,CAAaC,IAAAA;AAAM,KAAA,CAAA;AACjE,CAAA;AAEA,MAAMiB,MAAAA,GAAS;AAEbZ,UAAAA,GAAAA;IAEA,MAAMS,WAAAA,GAAc,MAAMV,oBAAAA,CAAqBC,UAAAA,CAAAA;IAE/Ce,eAAAA,CAAgBN,WAAAA,CAAAA;IAEhB,OAAOA,WAAAA;AACT,CAAA;AAEA,MAAMU,mBAAmB,OACvBnB,UAAAA,GAAAA;IAEA,MAAMS,WAAAA,GAAc,MAAMjB,MAAAA,CAAOkB,EAAE,CAACU,WAAW,CAAC,OAAO,EAAEC,GAAG,EAAE,GAAA;;;QAG5D,MAAMC,cAAAA,GAAiB,MAAM9B,MAAAA,CAAOkB,EAAE,CACnCa,YAAY,CAAC,aAAA,CAAA,CACbC,MAAM,CAAC;AAAC,YAAA;AAAK,SAAA,CAAA,CACbC,KAAK,CAAC;YAAEC,IAAAA,EAAM7C;AAAiB,SAAA,CAAA,CAC/B8C,KAAK,EAAA,CACLC,WAAW,CAACP,GAAAA,CAAAA,CACZQ,SAAS,GACTC,OAAO,EAAA;AAEV,QAAA,IAAI,CAACR,cAAAA,EAAgB;AACnB,YAAA,MAAM,IAAIvC,gBAAAA,CACR,6EAAA,CAAA;AAEJ,QAAA;AAEA,QAAA,MAAMgD,WAAW,MAAMC,MAAAA,EAAAA;AAEvB,QAAA,IAAID,QAAAA,EAAU;AACZ,YAAA,MAAM,IAAIhD,gBAAAA,CAAiB,uCAAA,CAAA;AAC7B,QAAA;AAEA,QAAA,OAAOgB,oBAAAA,CAAqB;AAC1B,YAAA,GAAGC,UAAU;YACbE,iBAAAA,EAAmB,IAAA;YACnB+B,QAAAA,EAAU,IAAA;YACVpC,KAAAA,EAAO;AAACyB,gBAAAA,cAAAA,CAAeY;AAAG;AAC5B,SAAA,CAAA;AACF,IAAA,CAAA,CAAA;IAEAnB,eAAAA,CAAgBN,WAAAA,CAAAA;IAEhB,OAAOA,WAAAA;AACT,CAAA;AAEA;;;;IAKA,MAAM0B,UAAAA,GAAa,OACjBD,EAAAA,EACAlC,UAAAA,GAAAA;;AAGA,IAAA,IAAIZ,UAAAA,CAAEiB,GAAG,CAACL,UAAAA,EAAY,OAAA,CAAA,EAAU;QAC9B,MAAMoC,aAAAA,GAAgB,MAAMC,oBAAAA,CAAqBH,EAAAA,CAAAA;AACjD,QAAA,MAAMZ,cAAAA,GAAiB,MAAMnB,UAAAA,CAAW,MAAA,CAAA,CAAQmC,2BAA2B,EAAA;QAC3E,MAAMC,wBAAAA,GAA2B,CAACC,MAAAA,CAAOC,cAAc,CAACzC,UAAAA,CAAWH,KAAK,EAAGyB,cAAAA,CAAeY,EAAE,CAAA;AAE5F,QAAA,IAAIE,iBAAiBG,wBAAAA,EAA0B;AAC7C,YAAA,MAAM,IAAIvD,eAAAA,CAAgB,wDAAA,CAAA;AAC5B,QAAA;AACF,IAAA;;IAGA,IAAIgB,UAAAA,CAAWiC,QAAQ,KAAK,KAAA,EAAO;QACjC,MAAMG,aAAAA,GAAgB,MAAMC,oBAAAA,CAAqBH,EAAAA,CAAAA;AACjD,QAAA,IAAIE,aAAAA,EAAe;AACjB,YAAA,MAAM,IAAIpD,eAAAA,CAAgB,wDAAA,CAAA;AAC5B,QAAA;AACF,IAAA;;AAGA,IAAA,IAAII,UAAAA,CAAEiB,GAAG,CAACL,UAAAA,EAAY,UAAA,CAAA,EAAa;AACjC,QAAA,MAAM0C,iBAAiB,MAAMvC,UAAAA,CAAW,QAAQI,YAAY,CAACP,WAAWM,QAAQ,CAAA;QAEhF,MAAMqC,WAAAA,GAAc,MAAMnD,MAAAA,CAAOkB,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAeiC,MAAM,CAAC;YAC9DnB,KAAAA,EAAO;AAAES,gBAAAA;AAAG,aAAA;YACZrB,IAAAA,EAAM;AACJ,gBAAA,GAAGb,UAAU;gBACbM,QAAAA,EAAUoC;AACZ,aAAA;YACA5B,QAAAA,EAAU;AAAC,gBAAA;AAAQ;AACrB,SAAA,CAAA;AAEAtB,QAAAA,MAAAA,CAAOyB,QAAQ,CAACC,IAAI,CAAC,aAAA,EAAe;AAAEvB,YAAAA,IAAAA,EAAMD,YAAAA,CAAaiD,WAAAA;AAAa,SAAA,CAAA;QAEtE,OAAOA,WAAAA;AACT,IAAA;IAEA,MAAMA,WAAAA,GAAc,MAAMnD,MAAAA,CAAOkB,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAeiC,MAAM,CAAC;QAC9DnB,KAAAA,EAAO;AAAES,YAAAA;AAAG,SAAA;QACZrB,IAAAA,EAAMb,UAAAA;QACNc,QAAAA,EAAU;AAAC,YAAA;AAAQ;AACrB,KAAA,CAAA;AAEA,IAAA,IAAI6B,WAAAA,EAAa;AACfnD,QAAAA,MAAAA,CAAOyB,QAAQ,CAACC,IAAI,CAAC,aAAA,EAAe;AAAEvB,YAAAA,IAAAA,EAAMD,YAAAA,CAAaiD,WAAAA;AAAa,SAAA,CAAA;AACxE,IAAA;IAEA,OAAOA,WAAAA;AACT,CAAA;AAEA;;;;IAKA,MAAME,oBAAAA,GAAuB,OAAOC,KAAAA,EAAexC,UAAAA,GAAAA;IACjD,MAAMX,IAAAA,GAAO,MAAMH,MAAAA,CAAOkB,EAAE,CACzBC,KAAK,CAAC,aAAA,CAAA,CACNoC,OAAO,CAAC;QAAEtB,KAAAA,EAAO;AAAEqB,YAAAA;AAAM,SAAA;QAAGhC,QAAAA,EAAU;AAAC,YAAA;AAAQ;AAAC,KAAA,CAAA;AAEnD,IAAA,IAAI,CAACnB,IAAAA,EAAM;AACT,QAAA,MAAM,IAAIqD,KAAAA,CAAM,CAAC,0BAA0B,EAAEF,KAAAA,CAAAA,CAAO,CAAA;AACtD,IAAA;IAEA,IAAI;QACF,MAAMG,QAAAA,CAAkBC,QAAQ,CAAC5C,UAAAA,CAAAA;AACnC,IAAA,CAAA,CAAE,OAAO6C,KAAAA,EAAO;AACd,QAAA,MAAM,IAAInE,eAAAA,CACR,wGAAA,CAAA;AAEJ,IAAA;IAEA,MAAMmD,UAAAA,CAAWxC,IAAAA,CAAKuC,EAAE,EAAE;AAAE5B,kBAAAA;AAAS,KAAA,CAAA;AACvC,CAAA;AAEA;;;IAIA,MAAM+B,uBAAuB,OAAOe,MAAAA,GAAAA;IAClC,MAAMzD,IAAAA,GAAQ,MAAMoD,OAAAA,CAAQK,MAAAA,CAAAA;IAC5B,IAAI,CAACzD,MAAM,OAAO,KAAA;AAElB,IAAA,MAAM2B,cAAAA,GAAiB,MAAMnB,UAAAA,CAAW,MAAA,CAAA,CAAQmC,2BAA2B,EAAA;AAE3E,IAAA,OAAOhB,cAAAA,CAAe+B,UAAU,KAAK,CAAA,IAAKC,iBAAAA,CAAkB3D,IAAAA,CAAAA;AAC9D,CAAA;AAEA;;;IAIA,MAAM4D,wBAAwB,OAAOH,MAAAA,GAAAA;IACnC,MAAMI,WAAAA,GAAe,MAAMT,OAAAA,CAAQK,MAAAA,CAAAA;AAEnC,IAAA,IAAI,CAACI,WAAAA,IAAe,CAACF,iBAAAA,CAAkBE,cAAc,OAAO,KAAA;IAE5D,MAAM,CAACC,UAAAA,CAAW,GAAG,MAAMjE,MAAAA,CAAOkB,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAe+C,QAAQ,CAAC;QACjE5C,QAAAA,EAAU;YACRjB,KAAAA,EAAO;gBACL4B,KAAAA,EAAO;oBACLC,IAAAA,EAAM;wBAAEiC,GAAAA,EAAK9E;AAAiB;AAChC;AACF;AACF,SAAA;QACA+E,OAAAA,EAAS;YAAEC,SAAAA,EAAW;AAAM,SAAA;QAC5BC,KAAAA,EAAO,CAAA;QACPtC,MAAAA,EAAQ;AAAC,YAAA;AAAK;AAChB,KAAA,CAAA;AAEA,IAAA,OAAOiC,UAAAA,CAAWvB,EAAE,KAAKsB,WAAAA,CAAYtB,EAAE;AACzC,CAAA;AAEA;;;AAGC,IACD,MAAMF,MAAAA,GAAS,OAAOhC,UAAAA,GAAa,EAAa,GAAA;IAC9C,OAAQ,MAAMR,MAAAA,CAAOkB,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAeoD,KAAK,CAAC;QAAEtC,KAAAA,EAAOzB;KAAW,CAAA,GAAM,CAAA;AAC/E,CAAA;AAEA;;;;IAKA,MAAMgE,uBAAuB,OAC3B9D,iBAAAA,GAAAA;IAEA,MAAMP,IAAAA,GAAO,MAAMH,MAAAA,CAAOkB,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAeoC,OAAO,CAAC;QAAEtB,KAAAA,EAAO;AAAEvB,YAAAA;AAAkB;AAAE,KAAA,CAAA;AAEzF,IAAA,IAAI,CAACP,IAAAA,EAAM;QACT,OAAOsE,SAAAA;AACT,IAAA;IAEA,OAAO7E,UAAAA,CAAEC,IAAI,CAACM,IAAAA,EAAM;AAAC,QAAA,OAAA;AAAS,QAAA,WAAA;AAAa,QAAA;AAAW,KAAA,CAAA;AACxD,CAAA;AAEA;;;;;AAKC,IACD,MAAMuE,QAAAA,GAAW,OAAO,EACtBhE,iBAAiB,EACjBD,QAAQ,EAIT,GAAA;IACC,MAAMkE,YAAAA,GAAe,MAAM3E,MAAAA,CAAOkB,EAAE,CACjCC,KAAK,CAAC,aAAA,CAAA,CACNoC,OAAO,CAAC;QAAEtB,KAAAA,EAAO;AAAEvB,YAAAA;AAAkB;AAAE,KAAA,CAAA;AAE1C,IAAA,IAAI,CAACiE,YAAAA,EAAc;AACjB,QAAA,MAAM,IAAInF,eAAAA,CAAgB,2BAAA,CAAA;AAC5B,IAAA;AAEA,IAAA,OAAOmB,WAAW,MAAA,CAAA,CAAQgC,UAAU,CAACgC,YAAAA,CAAajC,EAAE,EAAE;AACpD5B,QAAAA,QAAAA,EAAUL,SAASK,QAAQ;AAC3B8D,QAAAA,SAAAA,EAAWnE,SAASmE,SAAS;AAC7BC,QAAAA,QAAAA,EAAUpE,SAASoE,QAAQ;QAC3BnE,iBAAAA,EAAmB,IAAA;QACnB+B,QAAAA,EAAU;AACZ,KAAA,CAAA;AACF,CAAA;AAEA;;AAEC,IACD,MAAMc,OAAAA,GAAU,OAAOb,EAAAA,EAAapB,QAAAA,GAAW;AAAC,IAAA;AAAQ,CAAA,GAAA;AACtD,IAAA,OAAOtB,OAAOkB,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAeoC,OAAO,CAAC;QAAEtB,KAAAA,EAAO;AAAES,YAAAA;AAAG,SAAA;AAAGpB,QAAAA;AAAS,KAAA,CAAA;AAC1E,CAAA;AAEA;;;;;AAKC,IACD,MAAMwD,cAAAA,GAAiB,OAAOxB,KAAAA,EAAehC,WAAW,EAAE,GAAA;AACxD,IAAA,OAAOtB,OAAOkB,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAeoC,OAAO,CAAC;QAC5CtB,KAAAA,EAAO;YAAEqB,KAAAA,EAAO;gBAAEyB,IAAAA,EAAMzB;AAAM;AAAE,SAAA;AAChChC,QAAAA;AACF,KAAA,CAAA;AACF,CAAA;AAEA;;AAEC,IACD,MAAM0D,QAAAA,GAAW,OAAOC,MAAAA,GAAS,EAAE,GAAA;IACjC,MAAM9D,KAAAA,GAAQnB,OACXkF,GAAG,CAAC,gBACJC,SAAS,CAAC,eAAeC,QAAAA,CAAS;QAAE9D,QAAAA,EAAU;AAAC,YAAA;AAAQ;KAAC,EAAG2D,MAAAA,CAAAA,CAAAA;AAE9D,IAAA,OAAOjF,OAAOkB,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAe6D,QAAQ,CAAC7D,KAAAA,CAAAA;AACjD,CAAA;AAEA;;IAGA,MAAMkE,aAAa,OAAO3C,EAAAA,GAAAA;;IAExB,MAAM4C,YAAAA,GAAiC,MAAMtF,MAAAA,CAAOkB,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAeoC,OAAO,CAAC;QAClFtB,KAAAA,EAAO;AAAES,YAAAA;AAAG,SAAA;QACZpB,QAAAA,EAAU;AAAC,YAAA;AAAQ;AACrB,KAAA,CAAA;AAEA,IAAA,IAAI,CAACgE,YAAAA,EAAc;QACjB,OAAO,IAAA;AACT,IAAA;AAEA,IAAA,IAAIA,YAAAA,EAAc;QAChB,IAAIA,YAAAA,CAAajF,KAAK,CAACkF,IAAI,CAAC,CAACC,CAAAA,GAAMA,CAAAA,CAAEtD,IAAI,KAAK7C,gBAAAA,CAAAA,EAAmB;AAC/D,YAAA,MAAMyC,cAAAA,GAAiB,MAAMnB,UAAAA,CAAW,MAAA,CAAA,CAAQmC,2BAA2B,EAAA;YAC3E,IAAIhB,cAAAA,CAAe+B,UAAU,KAAK,CAAA,EAAG;AACnC,gBAAA,MAAM,IAAIrE,eAAAA,CAAgB,wDAAA,CAAA;AAC5B,YAAA;AACF,QAAA;AACF,IAAA;IAEA,MAAMiG,WAAAA,GAAc,MAAMzF,MAAAA,CAAOkB,EAAE,CAChCC,KAAK,CAAC,aAAA,CAAA,CACNuE,MAAM,CAAC;QAAEzD,KAAAA,EAAO;AAAES,YAAAA;AAAG,SAAA;QAAGpB,QAAAA,EAAU;AAAC,YAAA;AAAQ;AAAC,KAAA,CAAA;;AAG/C,IAAA,MAAMrB,cAAAA,GAAiBH,iBAAAA,EAAAA;AACvB,IAAA,IAAIG,cAAAA,IAAkBA,cAAAA,CAAe0F,SAAS,CAAC,OAAA,CAAA,EAAU;AACvD,QAAA,MAAM1F,cAAAA,CAAe,OAAA,CAAA,CAAS2F,sBAAsB,CAACC,MAAAA,CAAOnD,EAAAA,CAAAA,CAAAA;AAC9D,IAAA;AAEA1C,IAAAA,MAAAA,CAAOyB,QAAQ,CAACC,IAAI,CAAC,aAAA,EAAe;AAAEvB,QAAAA,IAAAA,EAAMD,YAAAA,CAAauF,WAAAA;AAAa,KAAA,CAAA;IAEtE,OAAOA,WAAAA;AACT,CAAA;AAEA;;IAGA,MAAMK,cAAc,OAAOC,GAAAA,GAAAA;;AAEzB,IAAA,MAAMjE,cAAAA,GAAiB,MAAMnB,UAAAA,CAAW,MAAA,CAAA,CAAQmC,2BAA2B,EAAA;IAC3E,MAAMkD,sBAAAA,GAAyB,MAAMhG,MAAAA,CAAOkB,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAeoD,KAAK,CAAC;QACxEtC,KAAAA,EAAO;YACLS,EAAAA,EAAIqD,GAAAA;YACJ1F,KAAAA,EAAO;AAAEqC,gBAAAA,EAAAA,EAAIZ,eAAeY;AAAG;AACjC;AACF,KAAA,CAAA;IAEA,IAAIZ,cAAAA,CAAe+B,UAAU,KAAKmC,sBAAAA,EAAwB;AACxD,QAAA,MAAM,IAAIxG,eAAAA,CAAgB,wDAAA,CAAA;AAC5B,IAAA;AAEA,IAAA,MAAMyG,eAAe,EAAE;IACvB,KAAK,MAAMvD,MAAMqD,GAAAA,CAAK;QACpB,MAAMN,WAAAA,GAAc,MAAMzF,MAAAA,CAAOkB,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAeuE,MAAM,CAAC;YAC9DzD,KAAAA,EAAO;AAAES,gBAAAA;AAAG,aAAA;YACZpB,QAAAA,EAAU;AAAC,gBAAA;AAAQ;AACrB,SAAA,CAAA;;AAGA,QAAA,MAAMrB,cAAAA,GAAiBH,iBAAAA,EAAAA;AACvB,QAAA,IAAIG,cAAAA,IAAkBA,cAAAA,CAAe0F,SAAS,CAAC,OAAA,CAAA,EAAU;AACvD,YAAA,MAAM1F,cAAAA,CAAe,OAAA,CAAA,CAAS2F,sBAAsB,CAACC,MAAAA,CAAOnD,EAAAA,CAAAA,CAAAA;AAC9D,QAAA;AAEAuD,QAAAA,YAAAA,CAAaC,IAAI,CAACT,WAAAA,CAAAA;AACpB,IAAA;AAEAzF,IAAAA,MAAAA,CAAOyB,QAAQ,CAACC,IAAI,CAAC,aAAA,EAAe;AAClCyE,QAAAA,KAAAA,EAAOF,YAAAA,CAAa3F,GAAG,CAAC,CAACmF,cAAgBvF,YAAAA,CAAauF,WAAAA,CAAAA;AACxD,KAAA,CAAA;IAEA,OAAOQ,YAAAA;AACT,CAAA;AAEA;AACC,IACD,MAAMG,qBAAAA,GAAwB,UAAA;AAC5B,IAAA,OAAOpG,OAAOkB,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAeoD,KAAK,CAAC;QAC1CtC,KAAAA,EAAO;YACL5B,KAAAA,EAAO;gBACLqC,EAAAA,EAAI;oBAAE2D,KAAAA,EAAO;AAAK;AACpB;AACF;AACF,KAAA,CAAA;AACF,CAAA;AAEA;;;AAGC,IACD,MAAM9B,KAAAA,GAAQ,OAAOtC,KAAAA,GAAQ,EAAE,GAAA;AAC7B,IAAA,OAAOjC,OAAOkB,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAeoD,KAAK,CAAC;AAAEtC,QAAAA;AAAM,KAAA,CAAA;AACtD,CAAA;AAEA;;IAGA,MAAMqE,mBAAmB,OAAOC,MAAAA,GAAAA;IAC9B,MAAMJ,KAAAA,GAAQ,MAAMnG,MAAAA,CAAOkB,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAe+C,QAAQ,CAAC;QAC1DlC,MAAAA,EAAQ;AAAC,YAAA;AAAK,SAAA;QACdC,KAAAA,EAAO;YACL5B,KAAAA,EAAO;gBAAEqC,EAAAA,EAAI;oBAAE2D,KAAAA,EAAO;AAAK;AAAE;AAC/B;AACF,KAAA,CAAA;AAEA,IAAA,MAAMG,QAAQC,GAAG,CACfN,KAAAA,CAAM7F,GAAG,CAAC,CAACH,IAAAA,GAAAA;AACT,QAAA,OAAOH,OAAOkB,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAeiC,MAAM,CAAC;YAC3CnB,KAAAA,EAAO;AAAES,gBAAAA,EAAAA,EAAIvC,KAAKuC;AAAG,aAAA;YACrBrB,IAAAA,EAAM;gBAAEhB,KAAAA,EAAO;AAACkG,oBAAAA;AAAO;AAAC;AAC1B,SAAA,CAAA;AACF,IAAA,CAAA,CAAA,CAAA;AAEJ,CAAA;AAEA;AACC,IACD,MAAMG,iCAAAA,GAAoC,UAAA;AACxC,IAAA,MAAMnC,QAAQ,MAAM6B,qBAAAA,EAAAA;AAEpB,IAAA,IAAI7B,QAAQ,CAAA,EAAG;QACbvE,MAAAA,CAAO2G,GAAG,CAACC,IAAI,CAAC,CAAC,YAAY,EAAErC,KAAAA,CAAM,sBAAsB,CAAC,CAAA;AAC9D,IAAA;AACF,CAAA;AAEA;AACC,IACD,MAAMsC,iBAAAA,GAAoB,UAAA;IACxB,MAAMV,KAAAA,GAAQ,MAAMnG,MAAAA,CAAOkB,EAAE,CAACC,KAAK,CAAC,aAAA,CAAA,CAAe+C,QAAQ,CAAC;QAAElC,MAAAA,EAAQ;AAAC,YAAA;AAAmB;AAAC,KAAA,CAAA;AAE3F,IAAA,OAAOmE,MAAM7F,GAAG,CAAC,CAACH,IAAAA,GAASA,IAAAA,CAAK2G,gBAAgB,IAAI,IAAA,CAAA;AACtD,CAAA;AACA,WAAe;AACb1F,IAAAA,MAAAA;AACAO,IAAAA,gBAAAA;AACAgB,IAAAA,UAAAA;AACAH,IAAAA,MAAAA;AACAgC,IAAAA,oBAAAA;AACAE,IAAAA,QAAAA;AACAxE,IAAAA,YAAAA;AACAqD,IAAAA,OAAAA;AACAuB,IAAAA,cAAAA;AACAE,IAAAA,QAAAA;AACAK,IAAAA,UAAAA;AACAS,IAAAA,WAAAA;AACAM,IAAAA,qBAAAA;AACA7B,IAAAA,KAAAA;AACA+B,IAAAA,gBAAAA;AACAI,IAAAA,iCAAAA;AACArD,IAAAA,oBAAAA;AACAwD,IAAAA,iBAAAA;AACA9C,IAAAA;AACF,CAAA;;;;"}

package/dist/server/shared/utils/auth-cookie-domain.js

@@ -0,0 +1,41 @@
+'use strict';
+
+/**
+ * Domain attribute of the admin auth (access) token cookie, configurable
+ * through `admin.auth.cookie.domain` (falling back to `admin.auth.domain`) so
+ * multiple Strapi instances under the same parent domain share, or stay
+ * isolated to, the intended host.
+ *
+ * Browser-safe single source for both sides of the handoff: the admin panel
+ * cannot read server config, so the build transports the config value into
+ * the bundle through the internal `STRAPI_ADMIN_AUTH_COOKIE_DOMAIN` variable
+ * (see create-build-context.ts in @strapi/strapi); the server resolves the
+ * same config at runtime. Changing the domain requires an admin rebuild, like
+ * any other admin config change.
+ *
+ * Defaults to `undefined` (host-only cookie) to match the browser default and
+ * the refresh-cookie behaviour in `getRefreshCookieOptions` when no domain is
+ * configured. A host-only cookie and a `Domain`-scoped cookie are distinct
+ * entries in the browser cookie store, so set and delete must agree on the
+ * domain or logout leaves a colliding copy behind.
+ */ const DEFAULT_AUTH_COOKIE_DOMAIN = undefined;
+const isValidCookieDomain = (domain)=>{
+    // RFC 6265 domain-av: a host name. No leading dot required, no scheme, no
+    // path, no port, and none of the control/attribute-separator characters.
+    return !/[\x00-\x1F\x7F;,\s/:]/.test(domain);
+};
+const resolveAuthCookieDomain = (configuredDomain, warn = console.warn)=>{
+    const cookieDomain = (configuredDomain || '').trim();
+    if (!cookieDomain) {
+        return DEFAULT_AUTH_COOKIE_DOMAIN;
+    }
+    if (!isValidCookieDomain(cookieDomain)) {
+        warn(`Ignoring invalid admin auth cookie domain "${cookieDomain}" (must be a bare host name); using a host-only cookie instead.`);
+        return DEFAULT_AUTH_COOKIE_DOMAIN;
+    }
+    return cookieDomain;
+};
+
+exports.DEFAULT_AUTH_COOKIE_DOMAIN = DEFAULT_AUTH_COOKIE_DOMAIN;
+exports.resolveAuthCookieDomain = resolveAuthCookieDomain;
+//# sourceMappingURL=auth-cookie-domain.js.map

package/dist/server/shared/utils/auth-cookie-domain.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-cookie-domain.js","sources":["../../../../shared/utils/auth-cookie-domain.ts"],"sourcesContent":["/**\n * Domain attribute of the admin auth (access) token cookie, configurable\n * through `admin.auth.cookie.domain` (falling back to `admin.auth.domain`) so\n * multiple Strapi instances under the same parent domain share, or stay\n * isolated to, the intended host.\n *\n * Browser-safe single source for both sides of the handoff: the admin panel\n * cannot read server config, so the build transports the config value into\n * the bundle through the internal `STRAPI_ADMIN_AUTH_COOKIE_DOMAIN` variable\n * (see create-build-context.ts in @strapi/strapi); the server resolves the\n * same config at runtime. Changing the domain requires an admin rebuild, like\n * any other admin config change.\n *\n * Defaults to `undefined` (host-only cookie) to match the browser default and\n * the refresh-cookie behaviour in `getRefreshCookieOptions` when no domain is\n * configured. A host-only cookie and a `Domain`-scoped cookie are distinct\n * entries in the browser cookie store, so set and delete must agree on the\n * domain or logout leaves a colliding copy behind.\n */\nexport const DEFAULT_AUTH_COOKIE_DOMAIN = undefined;\n\nconst isValidCookieDomain = (domain: string): boolean => {\n  // RFC 6265 domain-av: a host name. No leading dot required, no scheme, no\n  // path, no port, and none of the control/attribute-separator characters.\n  return !/[\\x00-\\x1F\\x7F;,\\s/:]/.test(domain);\n};\n\nexport const resolveAuthCookieDomain = (\n  configuredDomain?: string,\n  warn: (message: string) => void = console.warn\n): string | undefined => {\n  const cookieDomain = (configuredDomain || '').trim();\n\n  if (!cookieDomain) {\n    return DEFAULT_AUTH_COOKIE_DOMAIN;\n  }\n\n  if (!isValidCookieDomain(cookieDomain)) {\n    warn(\n      `Ignoring invalid admin auth cookie domain \"${cookieDomain}\" (must be a bare host name); using a host-only cookie instead.`\n    );\n    return DEFAULT_AUTH_COOKIE_DOMAIN;\n  }\n\n  return cookieDomain;\n};\n"],"names":["DEFAULT_AUTH_COOKIE_DOMAIN","undefined","isValidCookieDomain","domain","test","resolveAuthCookieDomain","configuredDomain","warn","console","cookieDomain","trim"],"mappings":";;AAAA;;;;;;;;;;;;;;;;;;IAmBO,MAAMA,0BAAAA,GAA6BC;AAE1C,MAAMC,sBAAsB,CAACC,MAAAA,GAAAA;;;IAG3B,OAAO,CAAC,uBAAA,CAAwBC,IAAI,CAACD,MAAAA,CAAAA;AACvC,CAAA;MAEaE,uBAAAA,GAA0B,CACrCC,gBAAAA,EACAC,IAAAA,GAAkCC,QAAQD,IAAI,GAAA;AAE9C,IAAA,MAAME,eAAe,CAACH,gBAAAA,IAAoB,EAAC,EAAGI,IAAI,EAAA;AAElD,IAAA,IAAI,CAACD,YAAAA,EAAc;QACjB,OAAOT,0BAAAA;AACT,IAAA;IAEA,IAAI,CAACE,oBAAoBO,YAAAA,CAAAA,EAAe;AACtCF,QAAAA,IAAAA,CACE,CAAC,2CAA2C,EAAEE,YAAAA,CAAa,+DAA+D,CAAC,CAAA;QAE7H,OAAOT,0BAAAA;AACT,IAAA;IAEA,OAAOS,YAAAA;AACT;;;;;"}

package/dist/server/shared/utils/auth-cookie-domain.mjs

@@ -0,0 +1,38 @@
+/**
+ * Domain attribute of the admin auth (access) token cookie, configurable
+ * through `admin.auth.cookie.domain` (falling back to `admin.auth.domain`) so
+ * multiple Strapi instances under the same parent domain share, or stay
+ * isolated to, the intended host.
+ *
+ * Browser-safe single source for both sides of the handoff: the admin panel
+ * cannot read server config, so the build transports the config value into
+ * the bundle through the internal `STRAPI_ADMIN_AUTH_COOKIE_DOMAIN` variable
+ * (see create-build-context.ts in @strapi/strapi); the server resolves the
+ * same config at runtime. Changing the domain requires an admin rebuild, like
+ * any other admin config change.
+ *
+ * Defaults to `undefined` (host-only cookie) to match the browser default and
+ * the refresh-cookie behaviour in `getRefreshCookieOptions` when no domain is
+ * configured. A host-only cookie and a `Domain`-scoped cookie are distinct
+ * entries in the browser cookie store, so set and delete must agree on the
+ * domain or logout leaves a colliding copy behind.
+ */ const DEFAULT_AUTH_COOKIE_DOMAIN = undefined;
+const isValidCookieDomain = (domain)=>{
+    // RFC 6265 domain-av: a host name. No leading dot required, no scheme, no
+    // path, no port, and none of the control/attribute-separator characters.
+    return !/[\x00-\x1F\x7F;,\s/:]/.test(domain);
+};
+const resolveAuthCookieDomain = (configuredDomain, warn = console.warn)=>{
+    const cookieDomain = (configuredDomain || '').trim();
+    if (!cookieDomain) {
+        return DEFAULT_AUTH_COOKIE_DOMAIN;
+    }
+    if (!isValidCookieDomain(cookieDomain)) {
+        warn(`Ignoring invalid admin auth cookie domain "${cookieDomain}" (must be a bare host name); using a host-only cookie instead.`);
+        return DEFAULT_AUTH_COOKIE_DOMAIN;
+    }
+    return cookieDomain;
+};
+
+export { DEFAULT_AUTH_COOKIE_DOMAIN, resolveAuthCookieDomain };
+//# sourceMappingURL=auth-cookie-domain.mjs.map

package/dist/server/shared/utils/auth-cookie-domain.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-cookie-domain.mjs","sources":["../../../../shared/utils/auth-cookie-domain.ts"],"sourcesContent":["/**\n * Domain attribute of the admin auth (access) token cookie, configurable\n * through `admin.auth.cookie.domain` (falling back to `admin.auth.domain`) so\n * multiple Strapi instances under the same parent domain share, or stay\n * isolated to, the intended host.\n *\n * Browser-safe single source for both sides of the handoff: the admin panel\n * cannot read server config, so the build transports the config value into\n * the bundle through the internal `STRAPI_ADMIN_AUTH_COOKIE_DOMAIN` variable\n * (see create-build-context.ts in @strapi/strapi); the server resolves the\n * same config at runtime. Changing the domain requires an admin rebuild, like\n * any other admin config change.\n *\n * Defaults to `undefined` (host-only cookie) to match the browser default and\n * the refresh-cookie behaviour in `getRefreshCookieOptions` when no domain is\n * configured. A host-only cookie and a `Domain`-scoped cookie are distinct\n * entries in the browser cookie store, so set and delete must agree on the\n * domain or logout leaves a colliding copy behind.\n */\nexport const DEFAULT_AUTH_COOKIE_DOMAIN = undefined;\n\nconst isValidCookieDomain = (domain: string): boolean => {\n  // RFC 6265 domain-av: a host name. No leading dot required, no scheme, no\n  // path, no port, and none of the control/attribute-separator characters.\n  return !/[\\x00-\\x1F\\x7F;,\\s/:]/.test(domain);\n};\n\nexport const resolveAuthCookieDomain = (\n  configuredDomain?: string,\n  warn: (message: string) => void = console.warn\n): string | undefined => {\n  const cookieDomain = (configuredDomain || '').trim();\n\n  if (!cookieDomain) {\n    return DEFAULT_AUTH_COOKIE_DOMAIN;\n  }\n\n  if (!isValidCookieDomain(cookieDomain)) {\n    warn(\n      `Ignoring invalid admin auth cookie domain \"${cookieDomain}\" (must be a bare host name); using a host-only cookie instead.`\n    );\n    return DEFAULT_AUTH_COOKIE_DOMAIN;\n  }\n\n  return cookieDomain;\n};\n"],"names":["DEFAULT_AUTH_COOKIE_DOMAIN","undefined","isValidCookieDomain","domain","test","resolveAuthCookieDomain","configuredDomain","warn","console","cookieDomain","trim"],"mappings":"AAAA;;;;;;;;;;;;;;;;;;IAmBO,MAAMA,0BAAAA,GAA6BC;AAE1C,MAAMC,sBAAsB,CAACC,MAAAA,GAAAA;;;IAG3B,OAAO,CAAC,uBAAA,CAAwBC,IAAI,CAACD,MAAAA,CAAAA;AACvC,CAAA;MAEaE,uBAAAA,GAA0B,CACrCC,gBAAAA,EACAC,IAAAA,GAAkCC,QAAQD,IAAI,GAAA;AAE9C,IAAA,MAAME,eAAe,CAACH,gBAAAA,IAAoB,EAAC,EAAGI,IAAI,EAAA;AAElD,IAAA,IAAI,CAACD,YAAAA,EAAc;QACjB,OAAOT,0BAAAA;AACT,IAAA;IAEA,IAAI,CAACE,oBAAoBO,YAAAA,CAAAA,EAAe;AACtCF,QAAAA,IAAAA,CACE,CAAC,2CAA2C,EAAEE,YAAAA,CAAa,+DAA+D,CAAC,CAAA;QAE7H,OAAOT,0BAAAA;AACT,IAAA;IAEA,OAAOS,YAAAA;AACT;;;;"}

package/dist/server/shared/utils/auth-cookie-name.js

@@ -0,0 +1,31 @@
+'use strict';
+
+/**
+ * Name of the cookie holding the admin auth (access) token, configurable
+ * through `admin.auth.cookie.name` so it cannot collide with a same-named
+ * cookie set by another application on a shared parent domain.
+ *
+ * Browser-safe single source for both sides of the SSO handoff: the admin
+ * panel cannot read server config, so the build transports the config value
+ * into the bundle through the internal `STRAPI_ADMIN_AUTH_COOKIE_NAME`
+ * variable (see create-build-context.ts in @strapi/strapi); the server
+ * resolves the same config at runtime. Renaming the cookie requires an admin
+ * rebuild, like any other admin config change.
+ */ const DEFAULT_AUTH_COOKIE_NAME = 'jwtToken';
+// RFC 6265 cookie-name token characters.
+const VALID_COOKIE_NAME = /^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/;
+const resolveAuthCookieName = (configuredName, warn = console.warn)=>{
+    const cookieName = (configuredName || '').trim();
+    if (!cookieName) {
+        return DEFAULT_AUTH_COOKIE_NAME;
+    }
+    if (!VALID_COOKIE_NAME.test(cookieName)) {
+        warn(`Ignoring invalid admin auth cookie name "${cookieName}" (must only contain RFC 6265 cookie-name characters); using "${DEFAULT_AUTH_COOKIE_NAME}" instead.`);
+        return DEFAULT_AUTH_COOKIE_NAME;
+    }
+    return cookieName;
+};
+
+exports.DEFAULT_AUTH_COOKIE_NAME = DEFAULT_AUTH_COOKIE_NAME;
+exports.resolveAuthCookieName = resolveAuthCookieName;
+//# sourceMappingURL=auth-cookie-name.js.map

package/dist/server/shared/utils/auth-cookie-name.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-cookie-name.js","sources":["../../../../shared/utils/auth-cookie-name.ts"],"sourcesContent":["/**\n * Name of the cookie holding the admin auth (access) token, configurable\n * through `admin.auth.cookie.name` so it cannot collide with a same-named\n * cookie set by another application on a shared parent domain.\n *\n * Browser-safe single source for both sides of the SSO handoff: the admin\n * panel cannot read server config, so the build transports the config value\n * into the bundle through the internal `STRAPI_ADMIN_AUTH_COOKIE_NAME`\n * variable (see create-build-context.ts in @strapi/strapi); the server\n * resolves the same config at runtime. Renaming the cookie requires an admin\n * rebuild, like any other admin config change.\n */\nexport const DEFAULT_AUTH_COOKIE_NAME = 'jwtToken';\n\n// RFC 6265 cookie-name token characters.\nconst VALID_COOKIE_NAME = /^[!#$%&'*+\\-.^_`|~0-9A-Za-z]+$/;\n\nexport const resolveAuthCookieName = (\n  configuredName?: string,\n  warn: (message: string) => void = console.warn\n): string => {\n  const cookieName = (configuredName || '').trim();\n\n  if (!cookieName) {\n    return DEFAULT_AUTH_COOKIE_NAME;\n  }\n\n  if (!VALID_COOKIE_NAME.test(cookieName)) {\n    warn(\n      `Ignoring invalid admin auth cookie name \"${cookieName}\" (must only contain RFC 6265 cookie-name characters); using \"${DEFAULT_AUTH_COOKIE_NAME}\" instead.`\n    );\n    return DEFAULT_AUTH_COOKIE_NAME;\n  }\n\n  return cookieName;\n};\n"],"names":["DEFAULT_AUTH_COOKIE_NAME","VALID_COOKIE_NAME","resolveAuthCookieName","configuredName","warn","console","cookieName","trim","test"],"mappings":";;AAAA;;;;;;;;;;;IAYO,MAAMA,wBAAAA,GAA2B;AAExC;AACA,MAAMC,iBAAAA,GAAoB,gCAAA;MAEbC,qBAAAA,GAAwB,CACnCC,cAAAA,EACAC,IAAAA,GAAkCC,QAAQD,IAAI,GAAA;AAE9C,IAAA,MAAME,aAAa,CAACH,cAAAA,IAAkB,EAAC,EAAGI,IAAI,EAAA;AAE9C,IAAA,IAAI,CAACD,UAAAA,EAAY;QACf,OAAON,wBAAAA;AACT,IAAA;AAEA,IAAA,IAAI,CAACC,iBAAAA,CAAkBO,IAAI,CAACF,UAAAA,CAAAA,EAAa;QACvCF,IAAAA,CACE,CAAC,yCAAyC,EAAEE,UAAAA,CAAW,8DAA8D,EAAEN,wBAAAA,CAAyB,UAAU,CAAC,CAAA;QAE7J,OAAOA,wBAAAA;AACT,IAAA;IAEA,OAAOM,UAAAA;AACT;;;;;"}

package/dist/server/shared/utils/auth-cookie-name.mjs

@@ -0,0 +1,28 @@
+/**
+ * Name of the cookie holding the admin auth (access) token, configurable
+ * through `admin.auth.cookie.name` so it cannot collide with a same-named
+ * cookie set by another application on a shared parent domain.
+ *
+ * Browser-safe single source for both sides of the SSO handoff: the admin
+ * panel cannot read server config, so the build transports the config value
+ * into the bundle through the internal `STRAPI_ADMIN_AUTH_COOKIE_NAME`
+ * variable (see create-build-context.ts in @strapi/strapi); the server
+ * resolves the same config at runtime. Renaming the cookie requires an admin
+ * rebuild, like any other admin config change.
+ */ const DEFAULT_AUTH_COOKIE_NAME = 'jwtToken';
+// RFC 6265 cookie-name token characters.
+const VALID_COOKIE_NAME = /^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/;
+const resolveAuthCookieName = (configuredName, warn = console.warn)=>{
+    const cookieName = (configuredName || '').trim();
+    if (!cookieName) {
+        return DEFAULT_AUTH_COOKIE_NAME;
+    }
+    if (!VALID_COOKIE_NAME.test(cookieName)) {
+        warn(`Ignoring invalid admin auth cookie name "${cookieName}" (must only contain RFC 6265 cookie-name characters); using "${DEFAULT_AUTH_COOKIE_NAME}" instead.`);
+        return DEFAULT_AUTH_COOKIE_NAME;
+    }
+    return cookieName;
+};
+
+export { DEFAULT_AUTH_COOKIE_NAME, resolveAuthCookieName };
+//# sourceMappingURL=auth-cookie-name.mjs.map

package/dist/server/shared/utils/auth-cookie-name.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-cookie-name.mjs","sources":["../../../../shared/utils/auth-cookie-name.ts"],"sourcesContent":["/**\n * Name of the cookie holding the admin auth (access) token, configurable\n * through `admin.auth.cookie.name` so it cannot collide with a same-named\n * cookie set by another application on a shared parent domain.\n *\n * Browser-safe single source for both sides of the SSO handoff: the admin\n * panel cannot read server config, so the build transports the config value\n * into the bundle through the internal `STRAPI_ADMIN_AUTH_COOKIE_NAME`\n * variable (see create-build-context.ts in @strapi/strapi); the server\n * resolves the same config at runtime. Renaming the cookie requires an admin\n * rebuild, like any other admin config change.\n */\nexport const DEFAULT_AUTH_COOKIE_NAME = 'jwtToken';\n\n// RFC 6265 cookie-name token characters.\nconst VALID_COOKIE_NAME = /^[!#$%&'*+\\-.^_`|~0-9A-Za-z]+$/;\n\nexport const resolveAuthCookieName = (\n  configuredName?: string,\n  warn: (message: string) => void = console.warn\n): string => {\n  const cookieName = (configuredName || '').trim();\n\n  if (!cookieName) {\n    return DEFAULT_AUTH_COOKIE_NAME;\n  }\n\n  if (!VALID_COOKIE_NAME.test(cookieName)) {\n    warn(\n      `Ignoring invalid admin auth cookie name \"${cookieName}\" (must only contain RFC 6265 cookie-name characters); using \"${DEFAULT_AUTH_COOKIE_NAME}\" instead.`\n    );\n    return DEFAULT_AUTH_COOKIE_NAME;\n  }\n\n  return cookieName;\n};\n"],"names":["DEFAULT_AUTH_COOKIE_NAME","VALID_COOKIE_NAME","resolveAuthCookieName","configuredName","warn","console","cookieName","trim","test"],"mappings":"AAAA;;;;;;;;;;;IAYO,MAAMA,wBAAAA,GAA2B;AAExC;AACA,MAAMC,iBAAAA,GAAoB,gCAAA;MAEbC,qBAAAA,GAAwB,CACnCC,cAAAA,EACAC,IAAAA,GAAkCC,QAAQD,IAAI,GAAA;AAE9C,IAAA,MAAME,aAAa,CAACH,cAAAA,IAAkB,EAAC,EAAGI,IAAI,EAAA;AAE9C,IAAA,IAAI,CAACD,UAAAA,EAAY;QACf,OAAON,wBAAAA;AACT,IAAA;AAEA,IAAA,IAAI,CAACC,iBAAAA,CAAkBO,IAAI,CAACF,UAAAA,CAAAA,EAAa;QACvCF,IAAAA,CACE,CAAC,yCAAyC,EAAEE,UAAAA,CAAW,8DAA8D,EAAEN,wBAAAA,CAAyB,UAAU,CAAC,CAAA;QAE7J,OAAOA,wBAAAA;AACT,IAAA;IAEA,OAAOM,UAAAA;AACT;;;;"}

package/dist/server/shared/utils/auth-cookie-path.js

@@ -0,0 +1,39 @@
+'use strict';
+
+/**
+ * Path attribute of the admin auth (access) token cookie, configurable
+ * through `admin.auth.cookie.path` so multiple Strapi instances on the same
+ * parent domain can keep separate cookies (e.g. `/strapi-de/admin`).
+ *
+ * Browser-safe single source for both sides of the handoff: the admin panel
+ * cannot read server config, so the build transports the config value into
+ * the bundle through the internal `STRAPI_ADMIN_AUTH_COOKIE_PATH` variable
+ * (see create-build-context.ts in @strapi/strapi); the server resolves the
+ * same config at runtime. Changing the path requires an admin rebuild, like
+ * any other admin config change.
+ *
+ * Defaults to `/admin` to match the refresh-cookie path used by
+ * `getRefreshCookieOptions`.
+ */ const DEFAULT_AUTH_COOKIE_PATH = '/admin';
+const isValidCookiePath = (path)=>{
+    if (!path.startsWith('/')) {
+        return false;
+    }
+    // RFC 6265 path-av: any CHAR except CTLs or ";".
+    return !/[\x00-\x1F\x7F;]/.test(path);
+};
+const resolveAuthCookiePath = (configuredPath, warn = console.warn)=>{
+    const cookiePath = (configuredPath || '').trim();
+    if (!cookiePath) {
+        return DEFAULT_AUTH_COOKIE_PATH;
+    }
+    if (!isValidCookiePath(cookiePath)) {
+        warn(`Ignoring invalid admin auth cookie path "${cookiePath}" (must be an absolute path without ";"); using "${DEFAULT_AUTH_COOKIE_PATH}" instead.`);
+        return DEFAULT_AUTH_COOKIE_PATH;
+    }
+    return cookiePath;
+};
+
+exports.DEFAULT_AUTH_COOKIE_PATH = DEFAULT_AUTH_COOKIE_PATH;
+exports.resolveAuthCookiePath = resolveAuthCookiePath;
+//# sourceMappingURL=auth-cookie-path.js.map

package/dist/server/shared/utils/auth-cookie-path.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-cookie-path.js","sources":["../../../../shared/utils/auth-cookie-path.ts"],"sourcesContent":["/**\n * Path attribute of the admin auth (access) token cookie, configurable\n * through `admin.auth.cookie.path` so multiple Strapi instances on the same\n * parent domain can keep separate cookies (e.g. `/strapi-de/admin`).\n *\n * Browser-safe single source for both sides of the handoff: the admin panel\n * cannot read server config, so the build transports the config value into\n * the bundle through the internal `STRAPI_ADMIN_AUTH_COOKIE_PATH` variable\n * (see create-build-context.ts in @strapi/strapi); the server resolves the\n * same config at runtime. Changing the path requires an admin rebuild, like\n * any other admin config change.\n *\n * Defaults to `/admin` to match the refresh-cookie path used by\n * `getRefreshCookieOptions`.\n */\nexport const DEFAULT_AUTH_COOKIE_PATH = '/admin';\n\nconst isValidCookiePath = (path: string): boolean => {\n  if (!path.startsWith('/')) {\n    return false;\n  }\n\n  // RFC 6265 path-av: any CHAR except CTLs or \";\".\n  return !/[\\x00-\\x1F\\x7F;]/.test(path);\n};\n\nexport const resolveAuthCookiePath = (\n  configuredPath?: string,\n  warn: (message: string) => void = console.warn\n): string => {\n  const cookiePath = (configuredPath || '').trim();\n\n  if (!cookiePath) {\n    return DEFAULT_AUTH_COOKIE_PATH;\n  }\n\n  if (!isValidCookiePath(cookiePath)) {\n    warn(\n      `Ignoring invalid admin auth cookie path \"${cookiePath}\" (must be an absolute path without \";\"); using \"${DEFAULT_AUTH_COOKIE_PATH}\" instead.`\n    );\n    return DEFAULT_AUTH_COOKIE_PATH;\n  }\n\n  return cookiePath;\n};\n"],"names":["DEFAULT_AUTH_COOKIE_PATH","isValidCookiePath","path","startsWith","test","resolveAuthCookiePath","configuredPath","warn","console","cookiePath","trim"],"mappings":";;AAAA;;;;;;;;;;;;;;IAeO,MAAMA,wBAAAA,GAA2B;AAExC,MAAMC,oBAAoB,CAACC,IAAAA,GAAAA;AACzB,IAAA,IAAI,CAACA,IAAAA,CAAKC,UAAU,CAAC,GAAA,CAAA,EAAM;QACzB,OAAO,KAAA;AACT,IAAA;;IAGA,OAAO,CAAC,kBAAA,CAAmBC,IAAI,CAACF,IAAAA,CAAAA;AAClC,CAAA;MAEaG,qBAAAA,GAAwB,CACnCC,cAAAA,EACAC,IAAAA,GAAkCC,QAAQD,IAAI,GAAA;AAE9C,IAAA,MAAME,aAAa,CAACH,cAAAA,IAAkB,EAAC,EAAGI,IAAI,EAAA;AAE9C,IAAA,IAAI,CAACD,UAAAA,EAAY;QACf,OAAOT,wBAAAA;AACT,IAAA;IAEA,IAAI,CAACC,kBAAkBQ,UAAAA,CAAAA,EAAa;QAClCF,IAAAA,CACE,CAAC,yCAAyC,EAAEE,UAAAA,CAAW,iDAAiD,EAAET,wBAAAA,CAAyB,UAAU,CAAC,CAAA;QAEhJ,OAAOA,wBAAAA;AACT,IAAA;IAEA,OAAOS,UAAAA;AACT;;;;;"}

package/dist/server/shared/utils/auth-cookie-path.mjs

@@ -0,0 +1,36 @@
+/**
+ * Path attribute of the admin auth (access) token cookie, configurable
+ * through `admin.auth.cookie.path` so multiple Strapi instances on the same
+ * parent domain can keep separate cookies (e.g. `/strapi-de/admin`).
+ *
+ * Browser-safe single source for both sides of the handoff: the admin panel
+ * cannot read server config, so the build transports the config value into
+ * the bundle through the internal `STRAPI_ADMIN_AUTH_COOKIE_PATH` variable
+ * (see create-build-context.ts in @strapi/strapi); the server resolves the
+ * same config at runtime. Changing the path requires an admin rebuild, like
+ * any other admin config change.
+ *
+ * Defaults to `/admin` to match the refresh-cookie path used by
+ * `getRefreshCookieOptions`.
+ */ const DEFAULT_AUTH_COOKIE_PATH = '/admin';
+const isValidCookiePath = (path)=>{
+    if (!path.startsWith('/')) {
+        return false;
+    }
+    // RFC 6265 path-av: any CHAR except CTLs or ";".
+    return !/[\x00-\x1F\x7F;]/.test(path);
+};
+const resolveAuthCookiePath = (configuredPath, warn = console.warn)=>{
+    const cookiePath = (configuredPath || '').trim();
+    if (!cookiePath) {
+        return DEFAULT_AUTH_COOKIE_PATH;
+    }
+    if (!isValidCookiePath(cookiePath)) {
+        warn(`Ignoring invalid admin auth cookie path "${cookiePath}" (must be an absolute path without ";"); using "${DEFAULT_AUTH_COOKIE_PATH}" instead.`);
+        return DEFAULT_AUTH_COOKIE_PATH;
+    }
+    return cookiePath;
+};
+
+export { DEFAULT_AUTH_COOKIE_PATH, resolveAuthCookiePath };
+//# sourceMappingURL=auth-cookie-path.mjs.map

package/dist/server/shared/utils/auth-cookie-path.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-cookie-path.mjs","sources":["../../../../shared/utils/auth-cookie-path.ts"],"sourcesContent":["/**\n * Path attribute of the admin auth (access) token cookie, configurable\n * through `admin.auth.cookie.path` so multiple Strapi instances on the same\n * parent domain can keep separate cookies (e.g. `/strapi-de/admin`).\n *\n * Browser-safe single source for both sides of the handoff: the admin panel\n * cannot read server config, so the build transports the config value into\n * the bundle through the internal `STRAPI_ADMIN_AUTH_COOKIE_PATH` variable\n * (see create-build-context.ts in @strapi/strapi); the server resolves the\n * same config at runtime. Changing the path requires an admin rebuild, like\n * any other admin config change.\n *\n * Defaults to `/admin` to match the refresh-cookie path used by\n * `getRefreshCookieOptions`.\n */\nexport const DEFAULT_AUTH_COOKIE_PATH = '/admin';\n\nconst isValidCookiePath = (path: string): boolean => {\n  if (!path.startsWith('/')) {\n    return false;\n  }\n\n  // RFC 6265 path-av: any CHAR except CTLs or \";\".\n  return !/[\\x00-\\x1F\\x7F;]/.test(path);\n};\n\nexport const resolveAuthCookiePath = (\n  configuredPath?: string,\n  warn: (message: string) => void = console.warn\n): string => {\n  const cookiePath = (configuredPath || '').trim();\n\n  if (!cookiePath) {\n    return DEFAULT_AUTH_COOKIE_PATH;\n  }\n\n  if (!isValidCookiePath(cookiePath)) {\n    warn(\n      `Ignoring invalid admin auth cookie path \"${cookiePath}\" (must be an absolute path without \";\"); using \"${DEFAULT_AUTH_COOKIE_PATH}\" instead.`\n    );\n    return DEFAULT_AUTH_COOKIE_PATH;\n  }\n\n  return cookiePath;\n};\n"],"names":["DEFAULT_AUTH_COOKIE_PATH","isValidCookiePath","path","startsWith","test","resolveAuthCookiePath","configuredPath","warn","console","cookiePath","trim"],"mappings":"AAAA;;;;;;;;;;;;;;IAeO,MAAMA,wBAAAA,GAA2B;AAExC,MAAMC,oBAAoB,CAACC,IAAAA,GAAAA;AACzB,IAAA,IAAI,CAACA,IAAAA,CAAKC,UAAU,CAAC,GAAA,CAAA,EAAM;QACzB,OAAO,KAAA;AACT,IAAA;;IAGA,OAAO,CAAC,kBAAA,CAAmBC,IAAI,CAACF,IAAAA,CAAAA;AAClC,CAAA;MAEaG,qBAAAA,GAAwB,CACnCC,cAAAA,EACAC,IAAAA,GAAkCC,QAAQD,IAAI,GAAA;AAE9C,IAAA,MAAME,aAAa,CAACH,cAAAA,IAAkB,EAAC,EAAGI,IAAI,EAAA;AAE9C,IAAA,IAAI,CAACD,UAAAA,EAAY;QACf,OAAOT,wBAAAA;AACT,IAAA;IAEA,IAAI,CAACC,kBAAkBQ,UAAAA,CAAAA,EAAa;QAClCF,IAAAA,CACE,CAAC,yCAAyC,EAAEE,UAAAA,CAAW,iDAAiD,EAAET,wBAAAA,CAAyB,UAAU,CAAC,CAAA;QAEhJ,OAAOA,wBAAAA;AACT,IAAA;IAEA,OAAOS,UAAAA;AACT;;;;"}

package/dist/server/shared/utils/session-auth.js

@@ -1,12 +1,36 @@
 'use strict';
 
 var crypto = require('crypto');
+var utils = require('@strapi/utils');
+var authCookieName = require('./auth-cookie-name.js');
+var authCookiePath = require('./auth-cookie-path.js');
+var authCookieDomain = require('./auth-cookie-domain.js');
 
 function _interopDefault (e) { return e && e.__esModule ? e : { default: e }; }
 
 var crypto__default = /*#__PURE__*/_interopDefault(crypto);
 
+const ADMIN_ORIGIN = 'admin';
+const SESSION_CONTENT_TYPE = 'admin::session';
 const REFRESH_COOKIE_NAME = 'strapi_admin_refresh';
+// The resolvers are browser-shared (also inlined into the admin bundle) so
+// they default to console.warn; on the server, route their warnings through
+// the Strapi logger instead.
+const warnViaStrapiLog = (message)=>{
+    strapi.log.warn(message);
+};
+const getAccessCookieName = ()=>{
+    const configured = strapi.config.get('admin.auth.cookie.name');
+    return authCookieName.resolveAuthCookieName(configured, warnViaStrapiLog);
+};
+const getAccessCookiePath = ()=>{
+    const configured = strapi.config.get('admin.auth.cookie.path');
+    return authCookiePath.resolveAuthCookiePath(configured, warnViaStrapiLog);
+};
+const getAccessCookieDomain = ()=>{
+    const configured = strapi.config.get('admin.auth.cookie.domain') || strapi.config.get('admin.auth.domain');
+    return authCookieDomain.resolveAuthCookieDomain(configured, warnViaStrapiLog);
+};
 const DEFAULT_MAX_REFRESH_TOKEN_LIFESPAN = 30 * 24 * 60 * 60;
 const DEFAULT_IDLE_REFRESH_TOKEN_LIFESPAN = 14 * 24 * 60 * 60;
 const DEFAULT_MAX_SESSION_LIFESPAN = 1 * 24 * 60 * 60;
@@ -14,8 +38,8 @@ const DEFAULT_IDLE_SESSION_LIFESPAN = 2 * 60 * 60;
 const getRefreshCookieOptions = (secureRequest)=>{
     const configuredSecure = strapi.config.get('admin.auth.cookie.secure');
     const isProduction = process.env.NODE_ENV === 'production';
-    const domain = strapi.config.get('admin.auth.cookie.domain') || strapi.config.get('admin.auth.domain');
-    const path = strapi.config.get('admin.auth.cookie.path', '/admin');
+    const domain = getAccessCookieDomain();
+    const path = getAccessCookiePath();
     const sameSite = strapi.config.get('admin.auth.cookie.sameSite') ?? 'lax';
     let isSecure;
     if (typeof configuredSecure === 'boolean') {
@@ -75,6 +99,34 @@ const extractDeviceParams = (requestBody)=>{
         rememberMe
     };
 };
+const buildSessionMetadataFromContext = (ctx)=>utils.buildSessionMetadata({
+        userAgent: ctx.request.headers['user-agent']
+    });
+/**
+ * Resolves the device id to use when revoking sessions on logout.
+ * SSO assigns deviceId server-side, so the client-provided value may not match
+ * the active session row. Prefer the deviceId stored on the session backing
+ * the current access token when available.
+ *
+ * Callers should pass `ctx.state.session.id` from the admin auth strategy and
+ * the already-parsed body `deviceId` — the logout route requires authentication,
+ * so sessionId is expected to be present.
+ */ const resolveLogoutDeviceId = async (userId, sessionId, clientDeviceId)=>{
+    if (!sessionId) {
+        strapi.log.debug('resolveLogoutDeviceId: no sessionId; falling back to client deviceId');
+        return clientDeviceId;
+    }
+    const session = await strapi.db.query(SESSION_CONTENT_TYPE).findOne({
+        where: {
+            sessionId
+        }
+    });
+    if (session?.userId !== userId || session?.origin !== ADMIN_ORIGIN) {
+        strapi.log.debug('resolveLogoutDeviceId: access-token session missing or not owned; falling back to client deviceId');
+        return clientDeviceId;
+    }
+    return typeof session.deviceId === 'string' ? session.deviceId : clientDeviceId;
+};
 
 exports.DEFAULT_IDLE_REFRESH_TOKEN_LIFESPAN = DEFAULT_IDLE_REFRESH_TOKEN_LIFESPAN;
 exports.DEFAULT_IDLE_SESSION_LIFESPAN = DEFAULT_IDLE_SESSION_LIFESPAN;
@@ -82,8 +134,13 @@ exports.DEFAULT_MAX_REFRESH_TOKEN_LIFESPAN = DEFAULT_MAX_REFRESH_TOKEN_LIFESPAN;
 exports.DEFAULT_MAX_SESSION_LIFESPAN = DEFAULT_MAX_SESSION_LIFESPAN;
 exports.REFRESH_COOKIE_NAME = REFRESH_COOKIE_NAME;
 exports.buildCookieOptionsWithExpiry = buildCookieOptionsWithExpiry;
+exports.buildSessionMetadataFromContext = buildSessionMetadataFromContext;
 exports.extractDeviceParams = extractDeviceParams;
 exports.generateDeviceId = generateDeviceId;
+exports.getAccessCookieDomain = getAccessCookieDomain;
+exports.getAccessCookieName = getAccessCookieName;
+exports.getAccessCookiePath = getAccessCookiePath;
 exports.getRefreshCookieOptions = getRefreshCookieOptions;
 exports.getSessionManager = getSessionManager;
+exports.resolveLogoutDeviceId = resolveLogoutDeviceId;
 //# sourceMappingURL=session-auth.js.map

package/dist/server/shared/utils/session-auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"session-auth.js","sources":["../../../../shared/utils/session-auth.ts"],"sourcesContent":["import crypto from 'crypto';\nimport type { Modules } from '@strapi/types';\n\nexport const REFRESH_COOKIE_NAME = 'strapi_admin_refresh';\n\nexport const DEFAULT_MAX_REFRESH_TOKEN_LIFESPAN = 30 * 24 * 60 * 60;\nexport const DEFAULT_IDLE_REFRESH_TOKEN_LIFESPAN = 14 * 24 * 60 * 60;\nexport const DEFAULT_MAX_SESSION_LIFESPAN = 1 * 24 * 60 * 60;\nexport const DEFAULT_IDLE_SESSION_LIFESPAN = 2 * 60 * 60;\n\nexport const getRefreshCookieOptions = (secureRequest?: boolean) => {\n  const configuredSecure = strapi.config.get('admin.auth.cookie.secure');\n  const isProduction = process.env.NODE_ENV === 'production';\n\n  const domain: string | undefined =\n    strapi.config.get('admin.auth.cookie.domain') || strapi.config.get('admin.auth.domain');\n  const path: string = strapi.config.get('admin.auth.cookie.path', '/admin');\n\n  const sameSite: boolean | 'lax' | 'strict' | 'none' =\n    strapi.config.get('admin.auth.cookie.sameSite') ?? 'lax';\n\n  let isSecure: boolean;\n  if (typeof configuredSecure === 'boolean') {\n    isSecure = configuredSecure;\n  } else if (secureRequest !== undefined) {\n    isSecure = isProduction && secureRequest;\n  } else {\n    isSecure = isProduction;\n  }\n\n  return {\n    httpOnly: true,\n    secure: isSecure,\n    overwrite: true,\n    domain,\n    path,\n    sameSite,\n    maxAge: undefined,\n  };\n};\n\nconst getLifespansForType = (\n  type: 'refresh' | 'session'\n): { idleSeconds: number; maxSeconds: number } => {\n  if (type === 'refresh') {\n    const idleSeconds = Number(\n      strapi.config.get(\n        'admin.auth.sessions.idleRefreshTokenLifespan',\n        DEFAULT_IDLE_REFRESH_TOKEN_LIFESPAN\n      )\n    );\n    const maxSeconds = Number(\n      strapi.config.get(\n        'admin.auth.sessions.maxRefreshTokenLifespan',\n        DEFAULT_MAX_REFRESH_TOKEN_LIFESPAN\n      )\n    );\n\n    return { idleSeconds, maxSeconds };\n  }\n\n  const idleSeconds = Number(\n    strapi.config.get('admin.auth.sessions.idleSessionLifespan', DEFAULT_IDLE_SESSION_LIFESPAN)\n  );\n  const maxSeconds = Number(\n    strapi.config.get('admin.auth.sessions.maxSessionLifespan', DEFAULT_MAX_SESSION_LIFESPAN)\n  );\n\n  return { idleSeconds, maxSeconds };\n};\n\nexport const buildCookieOptionsWithExpiry = (\n  type: 'refresh' | 'session',\n  absoluteExpiresAtISO?: string,\n  secureRequest?: boolean\n) => {\n  const base = getRefreshCookieOptions(secureRequest);\n  if (type === 'session') {\n    return base;\n  }\n\n  const { idleSeconds } = getLifespansForType('refresh');\n  const now = Date.now();\n  const idleExpiry = now + idleSeconds * 1000;\n  const absoluteExpiry = absoluteExpiresAtISO\n    ? new Date(absoluteExpiresAtISO).getTime()\n    : idleExpiry;\n  const chosen = new Date(Math.min(idleExpiry, absoluteExpiry));\n\n  return { ...base, expires: chosen, maxAge: Math.max(0, chosen.getTime() - now) };\n};\n\nexport const getSessionManager = (): Modules.SessionManager.SessionManagerService | null => {\n  const manager = strapi.sessionManager as Modules.SessionManager.SessionManagerService | undefined;\n  return manager ?? null;\n};\n\nexport const generateDeviceId = (): string => crypto.randomUUID();\n\nexport const extractDeviceParams = (\n  requestBody: unknown\n): { deviceId: string; rememberMe: boolean } => {\n  const body = (requestBody ?? {}) as { deviceId?: string; rememberMe?: boolean };\n  const deviceId = body.deviceId || generateDeviceId();\n  const rememberMe = Boolean(body.rememberMe);\n\n  return { deviceId, rememberMe };\n};\n"],"names":["REFRESH_COOKIE_NAME","DEFAULT_MAX_REFRESH_TOKEN_LIFESPAN","DEFAULT_IDLE_REFRESH_TOKEN_LIFESPAN","DEFAULT_MAX_SESSION_LIFESPAN","DEFAULT_IDLE_SESSION_LIFESPAN","getRefreshCookieOptions","secureRequest","configuredSecure","strapi","config","get","isProduction","process","env","NODE_ENV","domain","path","sameSite","isSecure","undefined","httpOnly","secure","overwrite","maxAge","getLifespansForType","type","idleSeconds","Number","maxSeconds","buildCookieOptionsWithExpiry","absoluteExpiresAtISO","base","now","Date","idleExpiry","absoluteExpiry","getTime","chosen","Math","min","expires","max","getSessionManager","manager","sessionManager","generateDeviceId","crypto","randomUUID","extractDeviceParams","requestBody","body","deviceId","rememberMe","Boolean"],"mappings":";;;;;;;;AAGO,MAAMA,sBAAsB;AAE5B,MAAMC,kCAAAA,GAAqC,EAAA,GAAK,EAAA,GAAK,KAAK;AAC1D,MAAMC,mCAAAA,GAAsC,EAAA,GAAK,EAAA,GAAK,KAAK;AAC3D,MAAMC,4BAAAA,GAA+B,CAAA,GAAI,EAAA,GAAK,KAAK;AACnD,MAAMC,6BAAAA,GAAgC,CAAA,GAAI,EAAA,GAAK;AAE/C,MAAMC,0BAA0B,CAACC,aAAAA,GAAAA;AACtC,IAAA,MAAMC,gBAAAA,GAAmBC,MAAAA,CAAOC,MAAM,CAACC,GAAG,CAAC,0BAAA,CAAA;AAC3C,IAAA,MAAMC,YAAAA,GAAeC,OAAAA,CAAQC,GAAG,CAACC,QAAQ,KAAK,YAAA;IAE9C,MAAMC,MAAAA,GACJP,MAAAA,CAAOC,MAAM,CAACC,GAAG,CAAC,0BAAA,CAAA,IAA+BF,MAAAA,CAAOC,MAAM,CAACC,GAAG,CAAC,mBAAA,CAAA;AACrE,IAAA,MAAMM,OAAeR,MAAAA,CAAOC,MAAM,CAACC,GAAG,CAAC,wBAAA,EAA0B,QAAA,CAAA;AAEjE,IAAA,MAAMO,WACJT,MAAAA,CAAOC,MAAM,CAACC,GAAG,CAAC,4BAAA,CAAA,IAAiC,KAAA;IAErD,IAAIQ,QAAAA;IACJ,IAAI,OAAOX,qBAAqB,SAAA,EAAW;QACzCW,QAAAA,GAAWX,gBAAAA;IACb,CAAA,MAAO,IAAID,kBAAkBa,SAAAA,EAAW;AACtCD,QAAAA,QAAAA,GAAWP,YAAAA,IAAgBL,aAAAA;IAC7B,CAAA,MAAO;QACLY,QAAAA,GAAWP,YAAAA;AACb,IAAA;IAEA,OAAO;QACLS,QAAAA,EAAU,IAAA;QACVC,MAAAA,EAAQH,QAAAA;QACRI,SAAAA,EAAW,IAAA;AACXP,QAAAA,MAAAA;AACAC,QAAAA,IAAAA;AACAC,QAAAA,QAAAA;QACAM,MAAAA,EAAQJ;AACV,KAAA;AACF;AAEA,MAAMK,sBAAsB,CAC1BC,IAAAA,GAAAA;AAEA,IAAwB;AACtB,QAAA,MAAMC,cAAcC,MAAAA,CAClBnB,MAAAA,CAAOC,MAAM,CAACC,GAAG,CACf,8CAAA,EACAR,mCAAAA,CAAAA,CAAAA;AAGJ,QAAA,MAAM0B,aAAaD,MAAAA,CACjBnB,MAAAA,CAAOC,MAAM,CAACC,GAAG,CACf,6CAAA,EACAT,kCAAAA,CAAAA,CAAAA;QAIJ,OAAO;AAAEyB,YAAAA,WAAAA;AAAaE,YAAAA;AAAW,SAAA;AACnC,IAAA;AAUF,CAAA;AAEO,MAAMC,4BAAAA,GAA+B,CAC1CJ,IAAAA,EACAK,oBAAAA,EACAxB,aAAAA,GAAAA;AAEA,IAAA,MAAMyB,OAAO1B,uBAAAA,CAAwBC,aAAAA,CAAAA;AACrC,IAAA,IAAImB,SAAS,SAAA,EAAW;QACtB,OAAOM,IAAAA;AACT,IAAA;AAEA,IAAA,MAAM,EAAEL,WAAW,EAAE,GAAGF,mBAAAA,CAAoB,CAAA;IAC5C,MAAMQ,GAAAA,GAAMC,KAAKD,GAAG,EAAA;IACpB,MAAME,UAAAA,GAAaF,MAAMN,WAAAA,GAAc,IAAA;AACvC,IAAA,MAAMS,iBAAiBL,oBAAAA,GACnB,IAAIG,IAAAA,CAAKH,oBAAAA,CAAAA,CAAsBM,OAAO,EAAA,GACtCF,UAAAA;AACJ,IAAA,MAAMG,SAAS,IAAIJ,IAAAA,CAAKK,IAAAA,CAAKC,GAAG,CAACL,UAAAA,EAAYC,cAAAA,CAAAA,CAAAA;IAE7C,OAAO;AAAE,QAAA,GAAGJ,IAAI;QAAES,OAAAA,EAASH,MAAAA;AAAQd,QAAAA,MAAAA,EAAQe,KAAKG,GAAG,CAAC,CAAA,EAAGJ,MAAAA,CAAOD,OAAO,EAAA,GAAKJ,GAAAA;AAAK,KAAA;AACjF;MAEaU,iBAAAA,GAAoB,IAAA;IAC/B,MAAMC,OAAAA,GAAUnC,OAAOoC,cAAc;AACrC,IAAA,OAAOD,OAAAA,IAAW,IAAA;AACpB;AAEO,MAAME,gBAAAA,GAAmB,IAAcC,uBAAAA,CAAOC,UAAU;AAExD,MAAMC,sBAAsB,CACjCC,WAAAA,GAAAA;IAEA,MAAMC,IAAAA,GAAQD,eAAe,EAAC;IAC9B,MAAME,QAAAA,GAAWD,IAAAA,CAAKC,QAAQ,IAAIN,gBAAAA,EAAAA;IAClC,MAAMO,UAAAA,GAAaC,OAAAA,CAAQH,IAAAA,CAAKE,UAAU,CAAA;IAE1C,OAAO;AAAED,QAAAA,QAAAA;AAAUC,QAAAA;AAAW,KAAA;AAChC;;;;;;;;;;;;;"}
+{"version":3,"file":"session-auth.js","sources":["../../../../shared/utils/session-auth.ts"],"sourcesContent":["import crypto from 'crypto';\nimport type { Context } from 'koa';\nimport type { Modules } from '@strapi/types';\nimport { buildSessionMetadata } from '@strapi/utils';\n\nimport { resolveAuthCookieName } from './auth-cookie-name';\nimport { resolveAuthCookiePath } from './auth-cookie-path';\nimport { resolveAuthCookieDomain } from './auth-cookie-domain';\n\nconst ADMIN_ORIGIN = 'admin';\nconst SESSION_CONTENT_TYPE = 'admin::session';\n\nexport const REFRESH_COOKIE_NAME = 'strapi_admin_refresh';\n\n// The resolvers are browser-shared (also inlined into the admin bundle) so\n// they default to console.warn; on the server, route their warnings through\n// the Strapi logger instead.\nconst warnViaStrapiLog = (message: string): void => {\n  strapi.log.warn(message);\n};\n\nexport const getAccessCookieName = (): string => {\n  const configured: string | undefined = strapi.config.get('admin.auth.cookie.name');\n  return resolveAuthCookieName(configured, warnViaStrapiLog);\n};\n\nexport const getAccessCookiePath = (): string => {\n  const configured: string | undefined = strapi.config.get('admin.auth.cookie.path');\n  return resolveAuthCookiePath(configured, warnViaStrapiLog);\n};\n\nexport const getAccessCookieDomain = (): string | undefined => {\n  const configured: string | undefined =\n    strapi.config.get('admin.auth.cookie.domain') || strapi.config.get('admin.auth.domain');\n  return resolveAuthCookieDomain(configured, warnViaStrapiLog);\n};\n\nexport const DEFAULT_MAX_REFRESH_TOKEN_LIFESPAN = 30 * 24 * 60 * 60;\nexport const DEFAULT_IDLE_REFRESH_TOKEN_LIFESPAN = 14 * 24 * 60 * 60;\nexport const DEFAULT_MAX_SESSION_LIFESPAN = 1 * 24 * 60 * 60;\nexport const DEFAULT_IDLE_SESSION_LIFESPAN = 2 * 60 * 60;\n\nexport const getRefreshCookieOptions = (secureRequest?: boolean) => {\n  const configuredSecure = strapi.config.get('admin.auth.cookie.secure');\n  const isProduction = process.env.NODE_ENV === 'production';\n\n  const domain = getAccessCookieDomain();\n  const path = getAccessCookiePath();\n\n  const sameSite: boolean | 'lax' | 'strict' | 'none' =\n    strapi.config.get('admin.auth.cookie.sameSite') ?? 'lax';\n\n  let isSecure: boolean;\n  if (typeof configuredSecure === 'boolean') {\n    isSecure = configuredSecure;\n  } else if (secureRequest !== undefined) {\n    isSecure = isProduction && secureRequest;\n  } else {\n    isSecure = isProduction;\n  }\n\n  return {\n    httpOnly: true,\n    secure: isSecure,\n    overwrite: true,\n    domain,\n    path,\n    sameSite,\n    maxAge: undefined,\n  };\n};\n\nconst getLifespansForType = (\n  type: 'refresh' | 'session'\n): { idleSeconds: number; maxSeconds: number } => {\n  if (type === 'refresh') {\n    const idleSeconds = Number(\n      strapi.config.get(\n        'admin.auth.sessions.idleRefreshTokenLifespan',\n        DEFAULT_IDLE_REFRESH_TOKEN_LIFESPAN\n      )\n    );\n    const maxSeconds = Number(\n      strapi.config.get(\n        'admin.auth.sessions.maxRefreshTokenLifespan',\n        DEFAULT_MAX_REFRESH_TOKEN_LIFESPAN\n      )\n    );\n\n    return { idleSeconds, maxSeconds };\n  }\n\n  const idleSeconds = Number(\n    strapi.config.get('admin.auth.sessions.idleSessionLifespan', DEFAULT_IDLE_SESSION_LIFESPAN)\n  );\n  const maxSeconds = Number(\n    strapi.config.get('admin.auth.sessions.maxSessionLifespan', DEFAULT_MAX_SESSION_LIFESPAN)\n  );\n\n  return { idleSeconds, maxSeconds };\n};\n\nexport const buildCookieOptionsWithExpiry = (\n  type: 'refresh' | 'session',\n  absoluteExpiresAtISO?: string,\n  secureRequest?: boolean\n) => {\n  const base = getRefreshCookieOptions(secureRequest);\n  if (type === 'session') {\n    return base;\n  }\n\n  const { idleSeconds } = getLifespansForType('refresh');\n  const now = Date.now();\n  const idleExpiry = now + idleSeconds * 1000;\n  const absoluteExpiry = absoluteExpiresAtISO\n    ? new Date(absoluteExpiresAtISO).getTime()\n    : idleExpiry;\n  const chosen = new Date(Math.min(idleExpiry, absoluteExpiry));\n\n  return { ...base, expires: chosen, maxAge: Math.max(0, chosen.getTime() - now) };\n};\n\nexport const getSessionManager = (): Modules.SessionManager.SessionManagerService | null => {\n  const manager = strapi.sessionManager as Modules.SessionManager.SessionManagerService | undefined;\n  return manager ?? null;\n};\n\nexport const generateDeviceId = (): string => crypto.randomUUID();\n\nexport const extractDeviceParams = (\n  requestBody: unknown\n): { deviceId: string; rememberMe: boolean } => {\n  const body = (requestBody ?? {}) as { deviceId?: string; rememberMe?: boolean };\n  const deviceId = body.deviceId || generateDeviceId();\n  const rememberMe = Boolean(body.rememberMe);\n\n  return { deviceId, rememberMe };\n};\n\nexport const buildSessionMetadataFromContext = (ctx: Context) =>\n  buildSessionMetadata({\n    userAgent: ctx.request.headers['user-agent'],\n  });\n\n/**\n * Resolves the device id to use when revoking sessions on logout.\n * SSO assigns deviceId server-side, so the client-provided value may not match\n * the active session row. Prefer the deviceId stored on the session backing\n * the current access token when available.\n *\n * Callers should pass `ctx.state.session.id` from the admin auth strategy and\n * the already-parsed body `deviceId` — the logout route requires authentication,\n * so sessionId is expected to be present.\n */\nexport const resolveLogoutDeviceId = async (\n  userId: string,\n  sessionId: string | undefined,\n  clientDeviceId: string | undefined\n): Promise<string | undefined> => {\n  if (!sessionId) {\n    strapi.log.debug('resolveLogoutDeviceId: no sessionId; falling back to client deviceId');\n    return clientDeviceId;\n  }\n\n  const session = await strapi.db.query(SESSION_CONTENT_TYPE).findOne({\n    where: { sessionId },\n  });\n\n  if (session?.userId !== userId || session?.origin !== ADMIN_ORIGIN) {\n    strapi.log.debug(\n      'resolveLogoutDeviceId: access-token session missing or not owned; falling back to client deviceId'\n    );\n    return clientDeviceId;\n  }\n\n  return typeof session.deviceId === 'string' ? session.deviceId : clientDeviceId;\n};\n"],"names":["ADMIN_ORIGIN","SESSION_CONTENT_TYPE","REFRESH_COOKIE_NAME","warnViaStrapiLog","message","strapi","log","warn","getAccessCookieName","configured","config","get","resolveAuthCookieName","getAccessCookiePath","resolveAuthCookiePath","getAccessCookieDomain","resolveAuthCookieDomain","DEFAULT_MAX_REFRESH_TOKEN_LIFESPAN","DEFAULT_IDLE_REFRESH_TOKEN_LIFESPAN","DEFAULT_MAX_SESSION_LIFESPAN","DEFAULT_IDLE_SESSION_LIFESPAN","getRefreshCookieOptions","secureRequest","configuredSecure","isProduction","process","env","NODE_ENV","domain","path","sameSite","isSecure","undefined","httpOnly","secure","overwrite","maxAge","getLifespansForType","type","idleSeconds","Number","maxSeconds","buildCookieOptionsWithExpiry","absoluteExpiresAtISO","base","now","Date","idleExpiry","absoluteExpiry","getTime","chosen","Math","min","expires","max","getSessionManager","manager","sessionManager","generateDeviceId","crypto","randomUUID","extractDeviceParams","requestBody","body","deviceId","rememberMe","Boolean","buildSessionMetadataFromContext","ctx","buildSessionMetadata","userAgent","request","headers","resolveLogoutDeviceId","userId","sessionId","clientDeviceId","debug","session","db","query","findOne","where","origin"],"mappings":";;;;;;;;;;;;AASA,MAAMA,YAAAA,GAAe,OAAA;AACrB,MAAMC,oBAAAA,GAAuB,gBAAA;AAEtB,MAAMC,sBAAsB;AAEnC;AACA;AACA;AACA,MAAMC,mBAAmB,CAACC,OAAAA,GAAAA;IACxBC,MAAAA,CAAOC,GAAG,CAACC,IAAI,CAACH,OAAAA,CAAAA;AAClB,CAAA;MAEaI,mBAAAA,GAAsB,IAAA;AACjC,IAAA,MAAMC,UAAAA,GAAiCJ,MAAAA,CAAOK,MAAM,CAACC,GAAG,CAAC,wBAAA,CAAA;AACzD,IAAA,OAAOC,qCAAsBH,UAAAA,EAAYN,gBAAAA,CAAAA;AAC3C;MAEaU,mBAAAA,GAAsB,IAAA;AACjC,IAAA,MAAMJ,UAAAA,GAAiCJ,MAAAA,CAAOK,MAAM,CAACC,GAAG,CAAC,wBAAA,CAAA;AACzD,IAAA,OAAOG,qCAAsBL,UAAAA,EAAYN,gBAAAA,CAAAA;AAC3C;MAEaY,qBAAAA,GAAwB,IAAA;IACnC,MAAMN,UAAAA,GACJJ,MAAAA,CAAOK,MAAM,CAACC,GAAG,CAAC,0BAAA,CAAA,IAA+BN,MAAAA,CAAOK,MAAM,CAACC,GAAG,CAAC,mBAAA,CAAA;AACrE,IAAA,OAAOK,yCAAwBP,UAAAA,EAAYN,gBAAAA,CAAAA;AAC7C;AAEO,MAAMc,kCAAAA,GAAqC,EAAA,GAAK,EAAA,GAAK,KAAK;AAC1D,MAAMC,mCAAAA,GAAsC,EAAA,GAAK,EAAA,GAAK,KAAK;AAC3D,MAAMC,4BAAAA,GAA+B,CAAA,GAAI,EAAA,GAAK,KAAK;AACnD,MAAMC,6BAAAA,GAAgC,CAAA,GAAI,EAAA,GAAK;AAE/C,MAAMC,0BAA0B,CAACC,aAAAA,GAAAA;AACtC,IAAA,MAAMC,gBAAAA,GAAmBlB,MAAAA,CAAOK,MAAM,CAACC,GAAG,CAAC,0BAAA,CAAA;AAC3C,IAAA,MAAMa,YAAAA,GAAeC,OAAAA,CAAQC,GAAG,CAACC,QAAQ,KAAK,YAAA;AAE9C,IAAA,MAAMC,MAAAA,GAASb,qBAAAA,EAAAA;AACf,IAAA,MAAMc,IAAAA,GAAOhB,mBAAAA,EAAAA;AAEb,IAAA,MAAMiB,WACJzB,MAAAA,CAAOK,MAAM,CAACC,GAAG,CAAC,4BAAA,CAAA,IAAiC,KAAA;IAErD,IAAIoB,QAAAA;IACJ,IAAI,OAAOR,qBAAqB,SAAA,EAAW;QACzCQ,QAAAA,GAAWR,gBAAAA;IACb,CAAA,MAAO,IAAID,kBAAkBU,SAAAA,EAAW;AACtCD,QAAAA,QAAAA,GAAWP,YAAAA,IAAgBF,aAAAA;IAC7B,CAAA,MAAO;QACLS,QAAAA,GAAWP,YAAAA;AACb,IAAA;IAEA,OAAO;QACLS,QAAAA,EAAU,IAAA;QACVC,MAAAA,EAAQH,QAAAA;QACRI,SAAAA,EAAW,IAAA;AACXP,QAAAA,MAAAA;AACAC,QAAAA,IAAAA;AACAC,QAAAA,QAAAA;QACAM,MAAAA,EAAQJ;AACV,KAAA;AACF;AAEA,MAAMK,sBAAsB,CAC1BC,IAAAA,GAAAA;AAEA,IAAwB;AACtB,QAAA,MAAMC,cAAcC,MAAAA,CAClBnC,MAAAA,CAAOK,MAAM,CAACC,GAAG,CACf,8CAAA,EACAO,mCAAAA,CAAAA,CAAAA;AAGJ,QAAA,MAAMuB,aAAaD,MAAAA,CACjBnC,MAAAA,CAAOK,MAAM,CAACC,GAAG,CACf,6CAAA,EACAM,kCAAAA,CAAAA,CAAAA;QAIJ,OAAO;AAAEsB,YAAAA,WAAAA;AAAaE,YAAAA;AAAW,SAAA;AACnC,IAAA;AAUF,CAAA;AAEO,MAAMC,4BAAAA,GAA+B,CAC1CJ,IAAAA,EACAK,oBAAAA,EACArB,aAAAA,GAAAA;AAEA,IAAA,MAAMsB,OAAOvB,uBAAAA,CAAwBC,aAAAA,CAAAA;AACrC,IAAA,IAAIgB,SAAS,SAAA,EAAW;QACtB,OAAOM,IAAAA;AACT,IAAA;AAEA,IAAA,MAAM,EAAEL,WAAW,EAAE,GAAGF,mBAAAA,CAAoB,CAAA;IAC5C,MAAMQ,GAAAA,GAAMC,KAAKD,GAAG,EAAA;IACpB,MAAME,UAAAA,GAAaF,MAAMN,WAAAA,GAAc,IAAA;AACvC,IAAA,MAAMS,iBAAiBL,oBAAAA,GACnB,IAAIG,IAAAA,CAAKH,oBAAAA,CAAAA,CAAsBM,OAAO,EAAA,GACtCF,UAAAA;AACJ,IAAA,MAAMG,SAAS,IAAIJ,IAAAA,CAAKK,IAAAA,CAAKC,GAAG,CAACL,UAAAA,EAAYC,cAAAA,CAAAA,CAAAA;IAE7C,OAAO;AAAE,QAAA,GAAGJ,IAAI;QAAES,OAAAA,EAASH,MAAAA;AAAQd,QAAAA,MAAAA,EAAQe,KAAKG,GAAG,CAAC,CAAA,EAAGJ,MAAAA,CAAOD,OAAO,EAAA,GAAKJ,GAAAA;AAAK,KAAA;AACjF;MAEaU,iBAAAA,GAAoB,IAAA;IAC/B,MAAMC,OAAAA,GAAUnD,OAAOoD,cAAc;AACrC,IAAA,OAAOD,OAAAA,IAAW,IAAA;AACpB;AAEO,MAAME,gBAAAA,GAAmB,IAAcC,uBAAAA,CAAOC,UAAU;AAExD,MAAMC,sBAAsB,CACjCC,WAAAA,GAAAA;IAEA,MAAMC,IAAAA,GAAQD,eAAe,EAAC;IAC9B,MAAME,QAAAA,GAAWD,IAAAA,CAAKC,QAAQ,IAAIN,gBAAAA,EAAAA;IAClC,MAAMO,UAAAA,GAAaC,OAAAA,CAAQH,IAAAA,CAAKE,UAAU,CAAA;IAE1C,OAAO;AAAED,QAAAA,QAAAA;AAAUC,QAAAA;AAAW,KAAA;AAChC;AAEO,MAAME,+BAAAA,GAAkC,CAACC,GAAAA,GAC9CC,0BAAAA,CAAqB;AACnBC,QAAAA,SAAAA,EAAWF,GAAAA,CAAIG,OAAO,CAACC,OAAO,CAAC,YAAA;KACjC;AAEF;;;;;;;;;AASC,IACM,MAAMC,qBAAAA,GAAwB,OACnCC,QACAC,SAAAA,EACAC,cAAAA,GAAAA;AAEA,IAAA,IAAI,CAACD,SAAAA,EAAW;QACdtE,MAAAA,CAAOC,GAAG,CAACuE,KAAK,CAAC,sEAAA,CAAA;QACjB,OAAOD,cAAAA;AACT,IAAA;IAEA,MAAME,OAAAA,GAAU,MAAMzE,MAAAA,CAAO0E,EAAE,CAACC,KAAK,CAAC/E,oBAAAA,CAAAA,CAAsBgF,OAAO,CAAC;QAClEC,KAAAA,EAAO;AAAEP,YAAAA;AAAU;AACrB,KAAA,CAAA;AAEA,IAAA,IAAIG,OAAAA,EAASJ,MAAAA,KAAWA,MAAAA,IAAUI,OAAAA,EAASK,WAAWnF,YAAAA,EAAc;QAClEK,MAAAA,CAAOC,GAAG,CAACuE,KAAK,CACd,mGAAA,CAAA;QAEF,OAAOD,cAAAA;AACT,IAAA;AAEA,IAAA,OAAO,OAAOE,OAAAA,CAAQd,QAAQ,KAAK,QAAA,GAAWc,OAAAA,CAAQd,QAAQ,GAAGY,cAAAA;AACnE;;;;;;;;;;;;;;;;;;"}